1
vote

First time network designer needing some help with practicing with designs. Here is what I'm trying to implement to help me work out how to do others down the road.

The ISP will provide a public /27 address for the external interface network gateway router. I also have a private /24 address which I want to subnet (don't need VLSM)

I want 17 users to have cabled access to the network (web server/database server/email server/ and a printer). My business will maintain its own web/database/email servers. All 17 users must be on the same LAN also.

A wireless access point for external workers(subcontractors) to log in and access internet and the business servers.

What I am having trouble with is where to put the servers? Should each server be on it's own subnet? I'm not too bad at addressing and subneting but am stuck with how to design the topolgy/network of the whole package. I am hoping someone will lend me some wisdom as if I understand how to do this I will be able to create more scenarios to experiment.

closed as not constructive by Andrew, 87cd25770a, LapTop006, mdpc, Ward May 14 '13 at 1:57

As it currently stands, this question is not a good fit for our Q&A format. We expect answers to be supported by facts, references, or expertise, but this question will likely solicit debate, arguments, polling, or extended discussion. If you feel that this question can be improved and possibly reopened, visit the help center for guidance. If this question can be reworded to fit the rules in the help center, please edit the question.

locked by HopelessN00b Mar 16 '15 at 15:24

This question exists because it has historical significance, but it is not considered a good, on-topic question for this site so please do not use it as evidence that you can ask similar questions here. This question and its answers are frozen and cannot be changed. See the help center for guidance on writing a good question.

Read more about locked posts here.

2
votes

My general rule with subnetting and network design boils down to this: Resist the temptation to be overly clever. Or put another way, K.I.S.S.. You haven't listed any reasons for why you need to put your servers in a different subnet so why do it? Your network will be better served if you avoid this unnecessary complexity.

However, this doesn't mean you don't need a DMZ. A DMZ, does not by design require a separate subnet but for the sake of logical simplicity it's often easiest to construct it this way. Please see this question for more information on why a DMZ is necessary even for smallest of networks with publically facing services.

Depending on the business relation between your organization and your external workers you also might want to consider a separate VLAN or subnet for your wireless clients, think of it as a "wireless DMZ". If you plan on providing "public" wireless access to all of your visitors irregardless than you should seriously consider separating that traffic from your internal network and servers.

  • Additionally, if you're hosting your own email server, SNAT'ing the traffic from the Guest Wireless network will help protect your SMTP reputation and avoid being put on blacklists if someone with an infected laptop connects to the wireless and starts spamming out mail from your network. – fukawi2 May 12 '13 at 8:11
  • Thanks. There doesn't need to be a DMZ as this is only theoretical and DMZ is not covered by what i'm reading atm and the same goes with VLSM. Any guidance on how to set this up? Say it's 192.168.0.0 /24 address, I will put the LAN of 17 comps and printer server on one subnet. Should the database and email server be on a subnet together?I also wish the external wifi users to be able to only access the company server and internet, so – user173403 May 13 '13 at 5:42
  • Yes, there does need to be a DMZ. It doesn't need to be big or fancy but it needs to be there. You should read the FAQ, questions that are not practical, answerable questions based on actual problems that you face are off-topic. – 87cd25770a May 13 '13 at 5:46
  • Just been informed as DMZ is currently out of my knowledge atm, that the server only has to be on a seperate LAN. Im just having trouble with the whole topology (LAN/routers/switches) – user173403 May 13 '13 at 5:50

Not the answer you're looking for? Browse other questions tagged or ask your own question.