Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I've got 2 Netgear N300 (WNR2000v3) routers.

Here's my setup:

Modem > Router 1 > Private Users/Router 2 > Public Wireless Users on "Guest" Network.

I want to prevent users who are connected to Router 2's "Guest" network from accessing anything that is connected to Router 1. There is an option when setting up the "Guest" network called "Allow guest to access My Local Network" which I thought if unchecked would do this very thing; however, I can still access files and such of computers connected to Router 1.

Router 1 assigns 192.0.0.x IP addresses, Router 2 assigns 10.0.0.x IP addresses, how can they even see each other? Do I need to change the subnet or something else?

share|improve this question

migrated from Nov 17 '11 at 8:40

This question came from our site for information security professionals.

Some routers can have guest wireless network, that probably what is that setting about. You should use this feature instead of stacking routers. – Vitaly Nikolaev Nov 17 '11 at 3:28
In your case Guest network have full access to network for private users because... NAT. same way how Private users can access Internet... Btw, in your setup "Private" users dont have access to guest network :) – Vitaly Nikolaev Nov 17 '11 at 3:29
This is a sort of DMZ, DMZ is nearer to internet. put the public user near modem. – Vineet Menon Nov 17 '11 at 7:36
I don't want to use the "Guest Wireless Network" as I want to set throttling so as they can't use all my bandwidth. – Patrick Robert Shea O'Connor Dec 1 '11 at 19:51

Put a filewall between Router 2 and Router 1. Allow traffic from router 2 to go only to the internet.

share|improve this answer
Do you mean like a physical firewall box, or something software related? – Patrick Robert Shea O'Connor Dec 1 '11 at 19:52
A physical box. Either a firewall box or a computer with two NICs running firewall software. – this.josh Dec 2 '11 at 0:00

The best way i can think of is swap router 2 with router 1. so let the public network be first, then the private network. Machines is public area will not be able to connect to private area because of NAT. One issue would be some MITM attacks as internet data of private network would flow through public network.

share|improve this answer

The best way to achieve this goal is to make sure that Router 2 has a default gateway that points directly to the ISP providing Internet access. That should actually be the only route in the routing table for Router 2. Also Router 2 should not be running any active routing protocol or exchanging any routing information with Router 1.

share|improve this answer
I will try this out when I get home today, thanks for the suggestion. – Patrick Robert Shea O'Connor Dec 1 '11 at 19:51

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.