不管我们喜不喜欢，我们家里只有一些设备是不安全的，而且永远是不安全的。有没有一种安全的方法可以将这些设备添加到家庭网络而不损害其他设备的安全性？今天的超级用户问答帖子回答了一位有安全意识的读者的问题。

今天的问答环节是由SuperUser提供的，SuperUser是Stack Exchange的一个分支，是一个由社区驱动的问答网站分组。

问题

超级用户阅读器user1152285想知道如何安全地将不安全的设备添加到家庭网络：

I have a few Internet connected devices that I do not trust as being secure, but would like to use anyway (a **art television and some off-the-shelf home automation devices). I do not want to have them on the same network as my computers.

My current solution is to plug my cable modem into a switch and connect two wireless routers to the switch. My computers connect to the first router while everything else connects to the second one. Is this enough to completely isolate my computers from everything else?

I am also curious if there is a simpler solution using a single router that would effectively do the same thing? I have the following routers, both with DD-WRT:

• Netgear WNDR3700-v3
• Linksys WRT54G-v3

Except for a single computer on the first network, all of my other devices (secure and insecure) connect wirelessly.

如何安全地将不安全的设备添加到家庭网络？

答案

超级用户贡献者Anirudh Malhotra为我们提供了答案：

Your current solution is ok, but it will increase one switching hop plus the configuration overhead. You can achieve this with just one router by doing the following:

1. Configure two VLANs, then connect trusted hosts to one VLAN and untrusted hosts to another.
2. Configure your iptables to not allow trusted to non-trusted traffic (and vice-versa).

Hope this helps!

有什么要补充的解释吗？在评论中发出声音。想从其他精通技术的Stack Exchange用户那里了解更多答案吗？在这里查看完整的讨论主题。

图片来源：andybutkaj（Flickr）