Im working on a plan to isolate some parts of our work network.

Ideally some computers need to be decoupled from our main network (they do extremely sensitive work and so need to be extra secure from intrusion & pen testing). Whilst I am killer at breaking into networks building them is another thing entirely.

So far we have both networks isolated; were using a hardware router with DHCP for the outer "unsecure" network (and a couple of switches to connect everything in). For the inner "secure" network I am using pfsense for routing and DHCP.

The issue is connecting the 2. We need some form of "bridge" from the inner to the outer network; the inner network pc's need to be able to go on the internet to download windows updates etc. but all other internet access blocked. They also need some access to computers in the outer network; this includes some windows shares, a couple of web & db servers and our local anti-virus server.

All of this I know can be firewalled; the issue I am coming up against is how to do the bridge and firewall it (preferably with linux, can pfsense be configured to do this?). Im not even sure a "bridge" is the way forward.

Can anyone link me up with some solutions or ideas/tutorials to help with this?

Have I even gone about this the right way?

Once I get a pointer on the right track I think Im sorted :) it's just that first hurdle.


In pfSense, you should create three interfaces. One for your secure network (trusted) one for the internet (untrusted) and one for your normal network (untrusted) and only open the ports needed for the specific services to the specific interfaces.

| improve this answer | |

I'd look into ipsec how to at: http://www.ipsec-howto.org/

| improve this answer | |


if your high-sec computers will not have any access to the internet, why let them access the windows update servers directly? Would'nt it be much better to use a WSUS (Windows System Update Service) service installed with one of your domain controllers?

This way your high-sec boxes can be completely secured off the internet.

And all your other computers on the network can use this, too. Which will give you much more control with the updates management for your windows clients.

| improve this answer | |
  • Yes this is the long term plan. However we have software that auto-updates (and this is only way to receive updates - believe me it is aggravating! :D) on those machines so they need access to those update servers too. Sorry I shouldn't have just left that as etc. – Errant Sep 28 '09 at 11:26

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.