Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I'm the sysadmin at a small public library. Since I got here a few years ago, I've been trying to set up the network in a secure and simple way.

Security is a little tricky; the staff and patron networks need to be separated, for security reasons. Even if I further isolated the public wireless, I'd still rather not trust the security of our public computers. However, the two networks also need to communicate; even if I set up enough VMs so they didn't share any servers, they need to use the same two printers at the very least.

Currently, I'm solving this with some jerry-rigged commodity equipment. The patron network, linked together by switches, has a Windows server connected to it for DNS and DHCP and a DSL modem for a gateway. Also on the patron network is the WAN side of a Linksys router. This router is the "top" of the staff network, and has the same Windows server connected on a different port, providing DNS and DHCP, and another, faster DSL modem (separate connections are very useful, especially as we heavily depend on some cloud-hosted software). Both networks have wireless networks (staff secured with WPA, of course).

tl;dr: We have a public network, and a NATed staff network within it.

My question is; is this really the best way to do this? The right equipment would likely make my job easier, but anything with more than four ports and even rudimentary management quickly becomes a heavy hit on our budget.

(My original question was about an ungodly frustrating DHCP routing issue, but I thought I'd ask whether my network was broken rather than asking about the DHCP problem and being told my network was broken.)

share|improve this question
    
I'm having a difficult time understanding how your network is connected. Could you clarify how the network devices are connected? This is what concerns me: "Also on the patron network is the WAN side of a Linksys router. This router is the "top" of the staff network, and has the same Windows server connected on a different port, providing DNS and DHCP, and another, faster DSL modem (separate connections are very useful, especially as we heavily depend on some cloud-hosted software)." Is the same router connecting both networks? Which ports are connected to which network? –  Stemen May 29 '10 at 22:47
    
Network diagrams are a bonus. Even if it's scribbles in MS Paint. =) –  Wesley May 29 '10 at 22:56
    
i937.photobucket.com/albums/ad220/pianohacker/… Scribble in Inkscape work? :) –  pianohacker May 30 '10 at 8:06

1 Answer 1

up vote 2 down vote accepted

To me it seems to be a simple matter of using VLANs to separate the networks in question and then using network cards in the servers that can differentiate the VLAN traffic and responds accordingly. Of course, the switches need to be VLAN capable which, if they're not already, may be a bit more expensive than you can afford. ProCurve makes good 24-port 10/100 switches for under $400, if that's not too steep.

The topmost LinkSys may be a bit of an issue as far as seeing the VLANs is concerned. I know some of LinkSys's higher end stuff (if such a thing exists) can work with VLANs, but I never liked them. You may want to see if your LinkSys is candidate to have dd-wrt installed on it which can handle VLANs and may be a bit more robust as far as what it can do for you in other ways.

Or you could use one of your servers as the gateway/firewall. Drop IPCop on a reliable piece of equipment and be done with LinkSys forever.

share|improve this answer
    
Ahh, okay. VLANs sound nice, and there are indeed some reasonable ProCurve switches that support them. Our Linksys has DD-WRT (I would never have gotten this far otherwise), but the combination of it and the switch creates frustrating and intermittent routing problems. Integrating the two might help. How would I use VLAN-based security with VLAN-stupid devices (like, possibly, our leased printers)? Thanks for your ideas! –  pianohacker May 30 '10 at 8:15
    
@pianohacker Hmm... VLAN stupid devices are tricky. Do they absolutely have to be shared? Use a VLAN aware server as the print server and don't connect to it directly? You could possibly restrict access to times and days based on VLAN if you have to. –  Wesley May 31 '10 at 20:06
    
nonapeptide That sounds reasonable. This should make my job much easier, now just to convince the boss! Thanks again. –  pianohacker Jun 1 '10 at 4:46

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.