-2

I am starting my own business and have just ordered a server with SBS 2011 Essentials; a Dell T310. I have a Netgear FVS-538 dual wan Firewall and a Netgear JGS524F 24 port Gigabit switch (unmanaged). I have 1 desktop and two laptops that will connect to the domain controller. I have about 10 other devices (TV, DVD, SONOS whole house audio, phones, etc.) connecting to the same network.

I would like to segregate the network into two separate IP ranges; 1 for the server and 3 pcs and the other IP range for the other devices as well as guest devices. I am starting to realize that this would be easy if I had a managed switch because I could use VLANS but am wondering if it can be done with what I have.

My main concern is what is the best way to further secure my information from the rest of the network. My thought is that the domain controller will provide an increase in protection as far as security goes but I was wondering if there is a way to put it on a separate IP range to further separate it from the other traffic. I know that my firewall has "multi-home" which allows me to add static routes to connect to the internet. Outside of that, I am not sure how or if I can have to separate ranges. Also, if there is a better way to do this, that would be of great interest as well as I am no expert.

8
  • 4
    Send both of those Netgear devices back, and buy equipment that actually meets your needs. Sep 25, 2012 at 22:56
  • I probably should add that I was a home user first and have had the equipment for several years. Should I assume that what I am trying to do is not possible? Should I get a managed switch to do this an only put the devices on want on a separate lan and use it to provide the other IP range?
    – Mallard27
    Sep 25, 2012 at 23:11
  • You really need VLANs for this, and your firewall box only has one gigabit port. That makes it pretty much impossible to reuse either the firewall box or the switch. You'll just about have to replace both. Sep 25, 2012 at 23:14
  • Michael, thanks for your help! Is there anything you would suggest I can do with my current setup to better secure the server/pcs?
    – Mallard27
    Sep 25, 2012 at 23:17
  • if you cant seperate it, you can try encrypting it, using an ipsec tunnel perhaps. VLANs are the solution though, anything else is a bodge.
    – Sirex
    Sep 25, 2012 at 23:25

1 Answer 1

2

I think you're complicating this, but your firewall supports a DMZ configuration. Assuming these "untrusted" devices only need Internet access, uplink that 20-port switch into that Netgear's DMZ port and you're done (well, depending on how the DMZ is configured you might want to drop WAN any/any traffic to the DMZ as you're not really "serving" anything in there and it might be open to the outside by default).

Get another small switch for your "trusted" network and that'll go into the LAN port of the Netgear. Done. Simple three-legged router where the firewall controls access to/from the WAN, DMZ, and LAN.

If you want to permit some untrusted access to the LAN network, you'll need to modify the firewall rules because it's very likely the Netgear drops DMZ to LAN by default.

4
  • Thanks, that is what I was wondering. Not trying to overcomplicate so this sounds like a good solution. I really appreciate your help!
    – Mallard27
    Sep 26, 2012 at 1:28
  • Quick question: Am I way overthinking all of this. Is there any security issues or risk to my information having tv and the occassional friend connect to my network while having my pcs interfacing with a domain controller. I realize I sound like a total noob.
    – Mallard27
    Sep 26, 2012 at 1:37
  • 1
    Your TV, phones, and other devices are a much lesser risk to your network than even a guest machine, and that's mostly because you have no control over what/how that machine is taken care of. If you're really paranoid, I'd get an access point with "guest isolation" or just put that on the DMZ network.
    – gravyface
    Sep 26, 2012 at 1:50
  • Thanks. You just saved me purchasing all new hardware which I really didn't want to do. I do have a wireless router with guest isolation. I really appreciate your help!!! Have a great night!! - Mallard27
    – Mallard27
    Sep 26, 2012 at 1:53

Not the answer you're looking for? Browse other questions tagged .