0

My wife & I work from home (with two separate businesses, both in their early stages) and we have two teenage kids who represent the biggest risk. I am concerned about threats to our business data which is stored on a NAS (eg Cryptolocker) and wanted to improve security. We aren't exactly MI5, so precautions have to be commensurate with our circumstances. I have a detached backup, so our world wouldn't end, just trying to avoid a possible major headache.

I have some network knowledge and can work stuff out. I was wondering whether putting the kids on a separate network would contain any malware they might get? I would think that it would, but then I don't have an in-depth knowledge in networking. We would share one internet connection, but I have various routers & an ADSL modem.

I think this question answers mine - I have kids in the workplace but can't do anything about that! Kids + older computers + our network at the office: Security risk?

At present everything is connected through the ADSL Modem-router & a 10 port switch. I have a Vigor ADSL modem & a Netgear N600 I wanted to use with dd-wrt for the kids. What I'm not sure about is how I can connect the modem (only one port) & routers (each with 4 ports), if that is possible? Will this work?

enter image description here

1
  • I generally agree with apple4ever. I especially think that yes, you should have two different networks and keep the kids off the business network. The unmanaged switch will probably not work; you might need a device that NATs or, as apple4ever suggests, a router. Jan 15, 2016 at 18:00

2 Answers 2

0

First, to protect the NAS, ensure only the computers you want to have access to it do. For example protect it via authentication. Some NAS's such as those from Synology have internal firewalls. If yours has this, turn that on and allow only your computers access to it, though you'll have to set up a static IP for the computers you want).

If you split off the network as you are talking about, you can only have it on that network and only allow access from that network.

Separating the network would add some protection - especially if they are firewall-ed off. Connecting an un-managed switch as you suggested will probably not work - most modems only pass out one DHCP address.

The best solution is to place a router behind the modem, then other routers off of that. If you only have two, place the business computers behind one and connect that to the other router. As long as you have a separate DHCP network range on the LAN, and the WAN set to DHCP, that should work fine.

So it would be:

Modem---Main Router(192.168.1.0/24)---Kids computers
           |---- Business Router (192.168.2.0/24)---- Business computers

I've done setups like that and it works fine. Just remember to ensure there is a firewall (using something like DD-WRT is best to protect against router firmware security bugs).

3
  • Thanks for that info. It was the part after the modem that I am most unsure about. I've got the 2 modern routers and may have a couple of old ones lying around. Presumably though anything 10/100 will do as our FTTC broadband is around 30mbps? The NAS is a Synology & will ensure that the firewall is on. Jan 15, 2016 at 18:36
  • What is the disadvantage of running 2 routers instead of 3? Is it worth getting another router or would any old 10/100mbps one do? Jan 16, 2016 at 8:25
  • The biggest disadvantage is complexity and maintenance- ensuring that all of them are configured correctly, ensuring that changes in one don't break another, and keeping them all updated. I would definitely recommend having gigabit connections between the computers and the Sinology, as the speed will be noticeably different.
    – apple4ever
    Jan 20, 2016 at 18:14
0

Would it be possible to segment your network? Its not too difficult to get a basic cisco 10/100 switch and setup a few VLANS to create the number of networks you need. You could go as far as getting a few static IPs from your service provider and connecting 2 routers running NAT. One subnet for Work the other for Play. If its a nice enough switch its possible you could actually do all the routing on it (Layer 3)

3
  • Tks Nick, not sure I understand the meat of your reply and how many discrete suggestions in there. Not averse to buying kit, but has to A be proportional & B not make my life too complicated: I am a GIS bod who can do some IT... What would the benefit of having VLANs be? especially if I only really need 2 LANs. ISP only does static IPs for business accts -not an option Not sure if Layer 3 switch is for your first or second suggestion? Would switch go: Modem--->L3 Switch (with VLANS)---->everything attached & no router needed? Any VLAN PC could access networked peripherals? (would be good) Jan 15, 2016 at 20:01
  • VLANS would allow you to segment your traffic into two completely different networks. So you would have an actual home network and an actual business network. They would have two different sets of resources.
    – Nick Young
    Jan 15, 2016 at 21:36
  • If they're separate networks, what's virtual about them? They exist in the switch, rather than having 2 routers? Jan 15, 2016 at 22:46

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .