Want both WEP and WPA on home LAN

Hi, here's my situation:

* We have a home LAN. We use a Linksys WRT54G for routing and wifi. We
run WPA for better security.

* Our kids have their own computers. Sometimes their web browsing habits
are not the safest, in spite of the controls we've put in place. We'd
rather not give them (or any trojans they might download) access to our
computers, which contain financial data &etc.

* The kids also have a Wii and DS's that talk wifi. The DS's can only
use WEP.

So I'd like to have both WEP and WPA available, and I'd like to isolate
the kids' computers from ours. I think I can do this is with two
routers:


Broadband ----- WEP Router ---- WPA Router --- (grownup computers)
|
kid computers, DS's, etc

(The kid computers are attached to the WEP router, if that isn't clear.)

So the WPA router should give us NAT protection from the kids' computers.
If someone was able to hack into the WEP router, they still couldn't
access the grownup computers. I think the grownup computers should be
able to access any shares on the kid computers, right?

Anybody see any problem with this? Can I plug one router into another
like this, or can you only plug a switch/hub into a router? Will the kid
computers be able to get at the grownup computers, assuming we don't
intentionally open any ports? Is there a better way to do this?

Thanks!
Gary

"Gary Fritz" <(E-Mail Removed)> wrote in message
news:Xns9A2577EC4BCE0fritzfriicom@216.168.3.50...
> Hi, here's my situation:
>
> * We have a home LAN. We use a Linksys WRT54G for routing and wifi. We
> run WPA for better security.
>
> * Our kids have their own computers. Sometimes their web browsing habits
> are not the safest, in spite of the controls we've put in place. We'd
> rather not give them (or any trojans they might download) access to our
> computers, which contain financial data &etc.
>
> * The kids also have a Wii and DS's that talk wifi. The DS's can only
> use WEP.
>
> So I'd like to have both WEP and WPA available, and I'd like to isolate
> the kids' computers from ours. I think I can do this is with two
> routers:
>
>
> Broadband ----- WEP Router ---- WPA Router --- (grownup computers)
> |
> kid computers, DS's, etc
>
> (The kid computers are attached to the WEP router, if that isn't clear.)
>
> So the WPA router should give us NAT protection from the kids' computers.
> If someone was able to hack into the WEP router, they still couldn't
> access the grownup computers. I think the grownup computers should be
> able to access any shares on the kid computers, right?
>
> Anybody see any problem with this? Can I plug one router into another
> like this, or can you only plug a switch/hub into a router? Will the kid
> computers be able to get at the grownup computers, assuming we don't
> intentionally open any ports? Is there a better way to do this?
>
> Thanks!
> Gary

It's what I do when the objectives are the same as yours.
You can easily test the isolation and connectivity.

If the objectives are slightly different - you want to add a wireless router
in the middle of a wired network for example - then you can plug the LAN
side of the first router into the LAN side of the second router. That means
you use the second router as only a switch - with no NAT.

Fred

"Fred Marshall" <fmarshallx@remove_the_x.acm.org> wrote:
> It's what I do when the objectives are the same as yours.
> You can easily test the isolation and connectivity.

Cool. Thanks, Fred. I was told via email that cascading routers like this
can cause problems, but he didn't say what kind of problems. He also said
any decent router should handle both WEP and WPA simultaneously, but this
one doesn't. And that wouldn't give us the isolation I want.

So I'll go pick up another WRT54G -- or maybe something used, there's a USR
MaxG 5461 locally on craigslist for $25 -- set it up for WEP, plug it into
the broadband connection, and plug our WPA router into one of the ports on
the WEP router. I assume I should be able to set them up on different
channels so they don't interfere with each other. (And hopefully they also
won't interfere with our wireless broadband connection... :-)

Do I have to be careful about the private subnets I assign on the two
routers? We currently use 192.168.1.x on the WPA router. Will e.g.
192.168.10.x work OK on the WEP router, and provide the isolation I want?

Thanks!
Gary

I use a Draytek router, it does all of the below in one router. Nice.


"Gary Fritz" <(E-Mail Removed)> wrote in message
news:Xns9A2765D23ACE2fritzfriicom@216.168.3.50...
: "Fred Marshall" <fmarshallx@remove_the_x.acm.org> wrote:
: > It's what I do when the objectives are the same as yours.
: > You can easily test the isolation and connectivity.
:
: Cool. Thanks, Fred. I was told via email that cascading routers like
this
: can cause problems, but he didn't say what kind of problems. He also said
: any decent router should handle both WEP and WPA simultaneously, but this
: one doesn't. And that wouldn't give us the isolation I want.
:
: So I'll go pick up another WRT54G -- or maybe something used, there's a
USR
: MaxG 5461 locally on craigslist for $25 -- set it up for WEP, plug it into
: the broadband connection, and plug our WPA router into one of the ports on
: the WEP router. I assume I should be able to set them up on different
: channels so they don't interfere with each other. (And hopefully they
also
: won't interfere with our wireless broadband connection... :-)
:
: Do I have to be careful about the private subnets I assign on the two
: routers? We currently use 192.168.1.x on the WPA router. Will e.g.
: 192.168.10.x work OK on the WEP router, and provide the isolation I want?
:
: Thanks!
: Gary

"Cork Soaker" <(E-Mail Removed)> wrote:
> I use a Draytek router, it does all of the below in one router. Nice.

It also appears to cost about 3-5 times more than a Linksys. I'm not sure
we need that level of functionality for our small home office.

"Gary Fritz" <(E-Mail Removed)> wrote in message
news:Xns9A28619EBC093fritzfriicom@216.168.3.50...
: "Cork Soaker" <(E-Mail Removed)> wrote:
: > I use a Draytek router, it does all of the below in one router. Nice.
:
: It also appears to cost about 3-5 times more than a Linksys. I'm not sure
: we need that level of functionality for our small home office.

You just said you did.