Isolating a computer in the network

I've got a small network and want to isolate one of the computers from the whole network.

My Network:

                               <----> Trusted PC 1
ADSL Router --> Netgear dg834g <----> Trusted PC 2
<----> Untrusted PC


I want to isolate this untrusted PC in the network.

That means the network should be secure against : * ARP Poisoning * Sniffing * Untrusted PC should not see / reach any other computers within the network but can go out the internet.

• Static DHCP and switch usage solves the problem of sniffing/ARP poisoning.
• I can enable IPSec between computers but the real problem is sniffing the traffic between the router and one of the trusted computers.

• Against getting a new IP address (second IP address from the same computer) I need a firewall with port security (I think) or I don't think my ADSL router supports that.

To summarise I'm looking for a hardware firewall/router which can isolate one port from the rest of the network. Could you recommend such a hardware or can I easily accomplish that with my current network?

-
You didn't mentioned type of connection between PCs and dg834g Ethernet or Wireless. And are you planning to add more wired/wireless trusted/untrusted computers? –  SaveTheRbtz Jul 1 '09 at 21:12

Solution 1: Hide untrusted PC under another router. This will solve arp-spoofing/mitm problem.

Solution 2: Use any router with DD-WRT firmware. There you can setup different Wireless LANs and even put them in different VLANs. Too bad that ADSL modems aren't supported by it.

-
+1 for cheap solutions. Correct me if I'm wrong, but wouldn't you want the trusted PC's under a second router? This would add another firewall between them and the untrusted PC. Although you say ADSL isn't supported, couldn't he do a hybrid of your two solutions. Get a second router and put DD-WRT on it. Then, jack that into the port on the ADSL router. –  NYSystemsAnalyst Jul 1 '09 at 20:01
if you hide trusted PCs under router untrusted-one can spoof IP of router gateway(ADLS router) and intercept all traffic. And, yes the only solution with DD-WRT is to use second router, but still unless you setup firewall rules untrusted PC will be able to connect to trusted ones. –  SaveTheRbtz Jul 1 '09 at 20:26

A firewall with either several physical interfaces (atleast 3), or with virtual interface (VLAN) support will solve this for you. I think Linksys sells SBS VPN Routers that can do this cheap.

-

I can't specifically recommend a device, but the situation you're describing is called a DMZ and is often used to exclude servers from other parts of the network or other networks themselves (e.g. the internet).

-
This isn't necessarily a DMZ situation. A DMZ would leave the untrusted computer open to the Internet, at least on consumer level products. Just because he wants that computer isolated from the rest of the network does not mean he wants it open to access from the Internet. –  NYSystemsAnalyst Jul 1 '09 at 19:56
@NYSA - Not necessarily .. "DMZ" does not imply open to the internet (or unprotected). It really implies that the rest of the network is protected from the DMZ. Generally, the DMZ is behind a firewall, but specific services and computers are exposed through the firewall. –  tomjedrz Jul 1 '09 at 20:13

If you are really that concerned about it, then get a separate DSL account for that computer.

Otherwise you can pick up a DD-WRT Linksys router on ebay for $80 or so and set up a vlan. - I can't have a separate DSL with the same line. Otherwise that's what I'd have done. – Karma Soone Jul 1 '09 at 21:25 My favorite solution ... Astaro Security Gateway - free for non-commercial use - download the software and put it on an old PC with a couple of extra NICs - use the router as an access point.  -- NIC #2 - router - TRUSTED PCs DSL Modem -- NIC #1 - PC running ASG - -- NIC #3 - UNTRUSTED PC  Also, the Netgear site shows that the device you list has "exposed host (DMZ)" capabilities. Not sure if that means the "exposed" computer is isolated from the rest of the network, although the manual should make that clear. Alternatively, put the UNTRUSTED PCs behind a second router as SaveTheRbtz suggests. This will protect the trusted PC traffic from the untrusted PC, but does not protect the trusted PCs from attacks from a compromised untrusted PC.  -- Router 2 -- Untrusted PC DSL Modem -- Router 1 - -- Trusted PCs  EDIT: Put untrusted PC behind the router. This addresses original question concerns for untrusted PC seeing trusted PC traffic. - apologies to SaveTheRbtz - I think the only problem in here that untusted pc might control the traffic between "router 1" and "router 2". To avoid this I should use some MAC filtering/binding or static routing and none of them seems feasible with my hardware and setup. – Karma Soone Jul 1 '09 at 20:20 +1. In second scheme untrusted PC can intercept all taffic of Trusted ones. – SaveTheRbtz Jul 1 '09 at 20:47 See my EDIT to address these issues ... I skipped the "sniffing" part of the question. – tomjedrz Jul 1 '09 at 21:40 Look for VLAN support, anything above the normal consumer grade stuff should have it. We do it on our Draytek 3300, and on our Cisco Catalyst 3548 switch. - I want it for home so don't want to spend too much to be honest. But VLAN sounds like a good idea, do you know any cheap recommendations? – Karma Soone Jul 1 '09 at 19:50 If you can pick up some second hand Cisco kit (877 range, perhaps, or the 2900/2500 switches), that might be cheapest, I got a 3548 for £23 on Ebay. DD-WRT has vlan support, if you've got a router you can install that on, it's a free option. – Dentrasi Jul 1 '09 at 20:41 If you wanted to stop access entirely for that machine You could use mac filtering. - MACs can be easily spoofed. – SaveTheRbtz Sep 30 '09 at 15:24 @SaveTheRbtz - just one part of a puzzle. – MathewC Oct 1 '09 at 11:11 I have to agree with Adam, you need a DMZ. By not opening any ports from the Internet to the DMZ it cannot be accessed from the Internet but should still have Internet access. I suggest you forget about doing this with routers and switches and install a proper firewall and I highly recommend Smoothwall. - a super cheap solution is to have a small$10.00 workgroup switch after the modem but before the router. Then use the router to send out to your trusted PCs. thats if you want to have the untrusted pc on the internet. the router you use will need to be locked down and undetectable to even the "trusted" computers. is it sniffable? sure. is that probable? not really. cisco has a couple awesome switches with Vlan ect... for $100.00 on Ebay, they also have POE ports if you have wireless access points or IP security cameras. - PfSense on an ALIX board, ~$200 USD from Netgate. Powerful (500MHz proc, 256MB RAM), silent, passively-cooled, very low power consumption (~5 Watts avg.), 3 NICs (so you can setup a separate VLAN), and great community support.

-