Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I work from my home home office and have a VPN router to my company. I share the same network for my personal and office use. I have a WiFi Access Point, I don't want access to any of my company servers from WiFi for security reasons.

Currently all IP traffic is commingled, and I would like to separate it. Can anyone suggest an affordable configuration, keeping WiFi and Internet access for my personal use, and creating a different network (limited access) for my office use (no WiFi, VPN).

share|improve this question
    
What kind of Cisco router? An ASA55xx? If so it can be configured to keep everything separate. –  Chris S Aug 22 '12 at 12:42
2  
Most users wouldn't worry about such things as security. Kudos! –  ZnArK Aug 22 '12 at 14:28
add comment

5 Answers 5

up vote 8 down vote accepted

VLANS are not needed here !!!

Simply connect the VPN Router's WAN interface to the home router. Since all the Office traffic should be encrypted by the VPN tunnel, no home traffic would have access to work traffic.

The VPN router SHOULD NOT allow you to talk to your home machines when you are only connected to it in this configuration. If it does, your Network Team should be beaten with a bat. All traffic to the VPN router should be routed through the VPN Tunnel.

The only issue you may have is that you might have to disconnect from WIFI when connecting (via wired) to the VPN router or vice versa. Whether or not this is necessary has to do with your home and work's network configuration as well as your OS's interface metrics (can be changed, but beyond the scope of this question).

It sounds as though your current configuration is backwards. Just to clarify:

  • WRONG - [Home Router] -> [VPN Router] -> [Internet]
  • Correct - [VPN Router] -> [Home Router] -> [Internet]

Here's how this would look: enter image description here

Let me address some previous comments

Throwing a firewall at it doesn't help anything. If you are chaining NAT routers off each other, there is no good way to prevent the ones at the end of the chain from talking to the ones closer to the internet. As far as it is concerned, the office network is PART of the internet.

This is mostly a true statement. The VPN router will be able to talk to any other device closer to the internet. However; nothing behind the router will because of the VPN tunnel. The only thing that the devices on the home network will see are encrypted VPN packets.

Purchase two separate Internet connections. Plug your office into one and your home things into the other. No need to over think this one.

This would work..., but is not necessary. We're talking about an encrypted VPN tunnel... Let the VPN do it's business. This IS over thinking it!

share|improve this answer
    
This assumes that the VPN isn't split-tunnel. –  MDMarra Aug 22 '12 at 14:35
    
@MDMarra You're right. I am making a few assumptions here. If it was split tunneled, you could still use OpenWRT or dd-wrt (on the home router) to isolate all traffic from the VPN Router with a VLAN. IMHO, this would be better than paying for two separate internet connections, every month. –  ZnArK Aug 22 '12 at 14:41
add comment

Purchase two separate Internet connections. Plug your office into one and your home things into the other. No need to over think this one.

share|improve this answer
    
of course, simplest answer is always best. I leave access to my company through my cicso vnp router and my home will sit a on different connection. –  code-gijoe Aug 21 '12 at 21:38
3  
Agreed. This will be easier to deal with as far as tax write-offs go as well. –  EEAA Aug 21 '12 at 21:56
add comment

Buy a router that is capable of VLAN's Create two seperate VLANS one for Home and one for Work. Buying a router as a 1 time fee is better IMO than paying 2x.

share|improve this answer
add comment

Buy a switch that will support vlans.

Then create the amount of separate networks that you need to have.

You can also use your current router if you have one

This will save you alot of money.

share|improve this answer
add comment

to be more secure without 2 seperate net accounts ; buy a cheap firewall , connect the computers of office to firewall directly and home use computers to the router. You can now configure the detailed settings in firewall web interface. Even set priviledges to all clients seperatly

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.