Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Dear All, Please help me. I just joined a new Hospital and want some help managing my network.

There are some requirements: Current Network: There is a D.S.L connection and that is terminated on a LINUX proxy and then connected to D-Link layer 2 switches and then providing internet to more then 200 PC's (Would be increasing to 1500 in couple of months). D-Link switches are not configured yet. Also there is one Database server Report server and an application server. In near Future Application should be accessed by local users as well as remote users from internet via our web server. We do have a sharing server and all these servers databases and PC's are on single sub net.

Required Network: All i do want is to secure my network from outside access and just allowing specific users via web application and they will be submitting there record for patient card and appointment facility by means of application and entering there record (on our database) but not violating our network resources. Secondly in house users also need to access the same application and also internet but they must have some unique identity and rights (i.e. Finance lab dept. peoples do have limited access to that application).

Notes: Should i create V LAN or break sub nets. Having a firewall will solve my issues? is a router needed on these type of scenario's. Currently all the access are restricted from Linux Proxy.

Thanks.

share|improve this question
    
What O.S. are the you using on clients and servers? –  Massimo Apr 20 '10 at 7:06

2 Answers 2

If you are running Windows at least on client systems and one of your main needs is centralized authentication, I strongly suggest creating an Active Directory domain.

Also, a very good thing to do would be moving the proxy from its current gateway role and putting a proper firewall in its place.

To host Internet-facing web services (web, mail, etc.) also a DMZ should be considered.

Apart from these general suggestions, it's quite difficult to suggest more specific solutions without knowing a lot more about your network.

share|improve this answer
    
Thanks for the solution. I have to define further for better understandings. 1. Eth0 Connected to DSL internet. 2. ETH1 connected to Local area network (With IP Pool: 192.168.2.x) 3. ETH2 connected to Local area network (With IP Pool: 192.168.10.x) Description:I want to allow internet on ETH1 and Application/email/Sharing services on Eth2. Here ETH2 users will not allowed to browse or connect to internet. Problem:There are 20 users on Eth1 who will obviously browse internet but can also access services like Application server and other services running on ETH2.How can i allow using IPTABLES. –  Anonymous Apr 24 '10 at 9:30

Thanks for the solution. I have to define further for better understandings. 1. Eth0 Connected to DSL internet. 2. ETH1 connected to Local area network (With IP Pool: 192.168.2.x) 3. ETH2 connected to Local area network (With IP Pool: 192.168.10.x) Description:I want to allow internet on ETH1 and Application/email/Sharing services on Eth2. Here ETH2 users will not allowed to browse or connect to internet. Problem:There are 20 users on Eth1 who will obviously browse internet but can also access services like Application server and other services running on ETH2.How can i allow using IPTABLES.

share|improve this answer
    
You should add this info to your question. –  Massimo Apr 24 '10 at 14:26

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.