Home Network Paranoia
Some have called me paranoid, but I have a slogan of "Friends don't let friends use wireless networks." The reason for this is that wireless networks compromise the need for physical access to a network to perform any attack on the internal network.
Well, I of course, do have exceptions to my wireless rule. I'm planning on getting a new PDA with 802.11 capabilities, I'd like to be able to access the internet from it. As such, I've decided go add a wireless router to my home network. Before I did such, I wanted to make sure that my devices and laptop would only have access to the internet from the wireless network, and not to my internal network. I don't any stranger standing in the woods of my back yard able to access my TaxCut and MS Money files through a wireless hack, and considering the Feds can do it in 3 minutes now, I think my paranoia is justified.
I'm not a network security guru. I used to be a network administrator, but that was over 6 years ago and hardware was much different then. As such, I'm publishing my network layout and asking for comments or suggestions or holes that anyone might see.
As you can see, my internet access comes in through a cable modem which connects to a VoIP-capable router (yes, I use Vonage). The reason for using this router as my opening router is somewhat physical. In my garage, where I terminated all of my network runs, I also terminated a cable line and phone lines at a patch panel. Since the VoIP router also provides data ports, it's perfect for acting as a distribution for both my planned wireless router and my 8 port routing switch. The outgoing voice line patches into a telephone patch panel distribution that supplies the house telephone runs. The 8 port router serves as the first layer of defense for my data network It then provides access to the whole house through the patch panel distribution point where I ran all of my data lines to. (I luckily got to do all my own structured wiring while the house was being built).
Its important to note that I do not allow access from the wireless network across the internal side of the VoIP router, and I again block packets originating from the wireless router at the 8 port. The 8 port router and the VoIP router does, however have some rules for open ports that my wife needs to play games, and that I need for various services I have running on my internal network. Because of this, I've added another Cisco PIX firewall in my upstairs office to prevent any inbound requests to my file server, my development PC, and of course the computer I use for family record keeping. The file server is behind the firewall, but I have rules set up to allow access to it from the other house PC's.
In any case, as I look at my network, I start to realize how imperfect it is. I'm looking for advice from anyone on how to make it more secure but still provide the needed functionality to our standard home PC's and to our private personal-data machines.