Computer on Wan port of router

I'd normally ask this on the simple tech questions sticky, but it's full. Again. And will probably be full for days. Again. Suppose I want to use a router's firewall to protect a particularly sensitive computer from another local computer, but still transfer files from the more sensitive computer to the other one. And suppose I don't want to waste time doing two copy operations by using portable usb or oprical storage to do the transfer. Can I plug the less secure computer into the WAN port of the router and give it a static address in /etc/network/interfaces, then plug the more secure computer into one of the regular LAN ports, and send files to the static address configured on the computer plugged into the WAN interface?(USER WAS WARNED FOR THIS POST, You should always elaborate on your opinions rather than just spilling the soykaf. Yes you can but it won't work like you think without additional customisations at the router level.)

I am not sure about your particular question (it likely depends on the particular make of router how the WAN port is handled relative to the internal LAN ports), but what you probably want to do in general is look into VLANs.

The main idea is that I want to put a consumer-grade hardware router's firewall in between two local computers. The reason I want to do it is to perform one-way secure file transfers from a more secure computer to a less secure computer that might be infected with malware. The idea is that the router's firewall will protect the secure computer from being infected with any malware that might be on the less secure computer.

>>82311 >The main idea is that I want to put a consumer-grade hardware router's firewall in between two local computers. Yes, you can do this, and its a decent idea actually. Its called a DMZ, or a screened subnet. But, bascially there is some internal more secure network segment, an a less secure segment with a firewall in between. Realistically, you probably want something like this: ********* * Internet * * ****** * | ---------------------------- | Modem / Router | --------------------------- | --------------------------------------------------------------- | Switch (likely embeded in modem router) | ---------------------------------------------------------------- | | | Screening Firewall | | Less trusted machines | | | Trusted Segment | This would honestly be a pretty advanced setup for a home network, and most people would just use the firewalls builtin to the hosts. By adding a seperate additional firewall, you add cost and setup - but mitigate the risk that the trusted segment boxes are misconfigured or used by someone malicious. You would punch a hole for some file transfer service, perhaps http, in the screening firewall, so that all communication between less trusted machines and trusted segment but http are dropped.

>>82353 Thank you. Your diagram made it very simple what I can do and how to do it. Instead of messing with settings on the internet-connected router, I'm just going to use a second router with its WAN port plugged into a LAN port of the first router. I'll just have to be careful to prevent any confusion between the two DHCP servers. My secure section will have two router firewalls protecting it from the internet, and one router firewall protecting it from the insecure section. That's so simple even I can do it. And it should work with even the dumbest of routers. :)

>>82355 not that lain but wanted to add. i believe you can specify in firewall settings for outgoing or incoming traffic only as well

>>82355 A firewall is a computer .. What you are concretely having is a software that will filter out packets between two interfaces .. It is a shame we have nothing like a hardware kill switch for Ports and Protocols .. Anything software introduces an attack surface that anything software or hardware can mess with ..