Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am starting my own business and have just ordered a server with SBS 2011 Essentials; a Dell T310. I have a Netgear FVS-538 dual wan Firewall and a Netgear JGS524F 24 port Gigabit switch (unmanaged). I have 1 desktop and two laptops that will connect to the domain controller. I have about 10 other devices (TV, DVD, SONOS whole house audio, phones, etc.) connecting to the same network.

I would like to segregate the network into two separate IP ranges; 1 for the server and 3 pcs and the other IP range for the other devices as well as guest devices. I am starting to realize that this would be easy if I had a managed switch because I could use VLANS but am wondering if it can be done with what I have.

My main concern is what is the best way to further secure my information from the rest of the network. My thought is that the domain controller will provide an increase in protection as far as security goes but I was wondering if there is a way to put it on a separate IP range to further separate it from the other traffic. I know that my firewall has "multi-home" which allows me to add static routes to connect to the internet. Outside of that, I am not sure how or if I can have to separate ranges. Also, if there is a better way to do this, that would be of great interest as well as I am no expert.

share|improve this question

closed as not constructive by MDMarra, gravyface, John Gardeniers, HopelessN00b, mdpc Oct 31 '12 at 16:52

As it currently stands, this question is not a good fit for our Q&A format. We expect answers to be supported by facts, references, or expertise, but this question will likely solicit debate, arguments, polling, or extended discussion. If you feel that this question can be improved and possibly reopened, visit the help center for guidance.If this question can be reworded to fit the rules in the help center, please edit the question.

Send both of those Netgear devices back, and buy equipment that actually meets your needs. – Michael Hampton Sep 25 '12 at 22:56
I probably should add that I was a home user first and have had the equipment for several years. Should I assume that what I am trying to do is not possible? Should I get a managed switch to do this an only put the devices on want on a separate lan and use it to provide the other IP range? – Mallard27 Sep 25 '12 at 23:11
You really need VLANs for this, and your firewall box only has one gigabit port. That makes it pretty much impossible to reuse either the firewall box or the switch. You'll just about have to replace both. – Michael Hampton Sep 25 '12 at 23:14
Michael, thanks for your help! Is there anything you would suggest I can do with my current setup to better secure the server/pcs? – Mallard27 Sep 25 '12 at 23:17
if you cant seperate it, you can try encrypting it, using an ipsec tunnel perhaps. VLANs are the solution though, anything else is a bodge. – Sirex Sep 25 '12 at 23:25
up vote 2 down vote accepted

I think you're complicating this, but your firewall supports a DMZ configuration. Assuming these "untrusted" devices only need Internet access, uplink that 20-port switch into that Netgear's DMZ port and you're done (well, depending on how the DMZ is configured you might want to drop WAN any/any traffic to the DMZ as you're not really "serving" anything in there and it might be open to the outside by default).

Get another small switch for your "trusted" network and that'll go into the LAN port of the Netgear. Done. Simple three-legged router where the firewall controls access to/from the WAN, DMZ, and LAN.

If you want to permit some untrusted access to the LAN network, you'll need to modify the firewall rules because it's very likely the Netgear drops DMZ to LAN by default.

share|improve this answer
Thanks, that is what I was wondering. Not trying to overcomplicate so this sounds like a good solution. I really appreciate your help! – Mallard27 Sep 26 '12 at 1:28
Quick question: Am I way overthinking all of this. Is there any security issues or risk to my information having tv and the occassional friend connect to my network while having my pcs interfacing with a domain controller. I realize I sound like a total noob. – Mallard27 Sep 26 '12 at 1:37
Your TV, phones, and other devices are a much lesser risk to your network than even a guest machine, and that's mostly because you have no control over what/how that machine is taken care of. If you're really paranoid, I'd get an access point with "guest isolation" or just put that on the DMZ network. – gravyface Sep 26 '12 at 1:50
Thanks. You just saved me purchasing all new hardware which I really didn't want to do. I do have a wireless router with guest isolation. I really appreciate your help!!! Have a great night!! - Mallard27 – Mallard27 Sep 26 '12 at 1:53

Not the answer you're looking for? Browse other questions tagged or ask your own question.