Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

My current setup has:

  • a pfsense firewall with 4 NICs and potential for a 5th
  • 1 48 port 3com switch, 1 24 port HP switch, willing to purchase more
  • subnet 1) edge (Windows Server 2003 for vpn through routing and remote access) and
  • subnet 2) LAN with one WS2003 domain controller/dns/wins etc., one WS2008 file server, one WS2003 running Vipre anti-virus and Time Limit Manager which controls client computer use, and about 50 pcs

I am looking for a network design for separating clients and staff. I could do two totally isolated subnets, but I'm wondering if there is anything in between so that staff and clients could share some resources such as printers and anti-virus servers, staff could access client resources, but not vice versa. I guess what I'm asking is can you configure subnets and/or vlans like this:

  • 1)edge for vpn
  • 2)services available to all other internal networks
  • 3)staff which can access services and clients
  • 4)clients which can access services but not staff

By access/non-access, I mean stronger separation than domain usernames and passwords.

share|improve this question

Network segregation is a good idea for many many reasons, separation of users and resources being one of them.

There's no reason why you can't put different classes / categories of user onto different networks and use your firewall / router to mediate access between those networks. pfSense is more than capable of doing this.

share|improve this answer
Correct. Segregate everything according to logical boundaries (printers, servers, workstations, user groups) and only let them route to each other if necessary. This can be done via access lists. If internet clients are involved, one of the subnets can be a DMZ. – lunchmeat317 Dec 30 '11 at 15:00

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.