Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Im working on a plan to isolate some parts of our work network.

Ideally some computers need to be decoupled from our main network (they do extremely sensitive work and so need to be extra secure from intrusion & pen testing). Whilst I am killer at breaking into networks building them is another thing entirely.

So far we have both networks isolated; were using a hardware router with DHCP for the outer "unsecure" network (and a couple of switches to connect everything in). For the inner "secure" network I am using pfsense for routing and DHCP.

The issue is connecting the 2. We need some form of "bridge" from the inner to the outer network; the inner network pc's need to be able to go on the internet to download windows updates etc. but all other internet access blocked. They also need some access to computers in the outer network; this includes some windows shares, a couple of web & db servers and our local anti-virus server.

All of this I know can be firewalled; the issue I am coming up against is how to do the bridge and firewall it (preferably with linux, can pfsense be configured to do this?). Im not even sure a "bridge" is the way forward.

Can anyone link me up with some solutions or ideas/tutorials to help with this?

Have I even gone about this the right way?

Once I get a pointer on the right track I think Im sorted :) it's just that first hurdle.

share|improve this question
add comment

3 Answers

up vote 1 down vote accepted

In pfSense, you should create three interfaces. One for your secure network (trusted) one for the internet (untrusted) and one for your normal network (untrusted) and only open the ports needed for the specific services to the specific interfaces.

share|improve this answer
add comment

I'd look into ipsec how to at: http://www.ipsec-howto.org/

share|improve this answer
add comment

Ok,

if your high-sec computers will not have any access to the internet, why let them access the windows update servers directly? Would'nt it be much better to use a WSUS (Windows System Update Service) service installed with one of your domain controllers?

This way your high-sec boxes can be completely secured off the internet.

And all your other computers on the network can use this, too. Which will give you much more control with the updates management for your windows clients.

share|improve this answer
    
Yes this is the long term plan. However we have software that auto-updates (and this is only way to receive updates - believe me it is aggravating! :D) on those machines so they need access to those update servers too. Sorry I shouldn't have just left that as etc. –  Errant Sep 28 '09 at 11:26
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.