My wife & I work from home (with two separate businesses, both in their early stages) and we have two teenage kids who represent the biggest risk. I am concerned about threats to our business data which is stored on a NAS (eg Cryptolocker) and wanted to improve security. We aren't exactly MI5, so precautions have to be commensurate with our circumstances. I have a detached backup, so our world wouldn't end, just trying to avoid a possible major headache.

I have some network knowledge and can work stuff out. I was wondering whether putting the kids on a separate network would contain any malware they might get? I would think that it would, but then I don't have an in-depth knowledge in networking. We would share one internet connection, but I have various routers & an ADSL modem.

I think this question answers mine - I have kids in the workplace but can't do anything about that! Kids + older computers + our network at the office: Security risk?

At present everything is connected through the ADSL Modem-router & a 10 port switch. I have a Vigor ADSL modem & a Netgear N600 I wanted to use with dd-wrt for the kids. What I'm not sure about is how I can connect the modem (only one port) & routers (each with 4 ports), if that is possible? Will this work?

enter image description here

  • I generally agree with apple4ever. I especially think that yes, you should have two different networks and keep the kids off the business network. The unmanaged switch will probably not work; you might need a device that NATs or, as apple4ever suggests, a router. – Katherine Villyard Jan 15 '16 at 18:00

First, to protect the NAS, ensure only the computers you want to have access to it do. For example protect it via authentication. Some NAS's such as those from Synology have internal firewalls. If yours has this, turn that on and allow only your computers access to it, though you'll have to set up a static IP for the computers you want).

If you split off the network as you are talking about, you can only have it on that network and only allow access from that network.

Separating the network would add some protection - especially if they are firewall-ed off. Connecting an un-managed switch as you suggested will probably not work - most modems only pass out one DHCP address.

The best solution is to place a router behind the modem, then other routers off of that. If you only have two, place the business computers behind one and connect that to the other router. As long as you have a separate DHCP network range on the LAN, and the WAN set to DHCP, that should work fine.

So it would be:

Modem---Main Router( computers
           |---- Business Router ( Business computers

I've done setups like that and it works fine. Just remember to ensure there is a firewall (using something like DD-WRT is best to protect against router firmware security bugs).

  • Thanks for that info. It was the part after the modem that I am most unsure about. I've got the 2 modern routers and may have a couple of old ones lying around. Presumably though anything 10/100 will do as our FTTC broadband is around 30mbps? The NAS is a Synology & will ensure that the firewall is on. – user3418765 Jan 15 '16 at 18:36
  • What is the disadvantage of running 2 routers instead of 3? Is it worth getting another router or would any old 10/100mbps one do? – user3418765 Jan 16 '16 at 8:25
  • The biggest disadvantage is complexity and maintenance- ensuring that all of them are configured correctly, ensuring that changes in one don't break another, and keeping them all updated. I would definitely recommend having gigabit connections between the computers and the Sinology, as the speed will be noticeably different. – apple4ever Jan 20 '16 at 18:14

Would it be possible to segment your network? Its not too difficult to get a basic cisco 10/100 switch and setup a few VLANS to create the number of networks you need. You could go as far as getting a few static IPs from your service provider and connecting 2 routers running NAT. One subnet for Work the other for Play. If its a nice enough switch its possible you could actually do all the routing on it (Layer 3)

  • Tks Nick, not sure I understand the meat of your reply and how many discrete suggestions in there. Not averse to buying kit, but has to A be proportional & B not make my life too complicated: I am a GIS bod who can do some IT... What would the benefit of having VLANs be? especially if I only really need 2 LANs. ISP only does static IPs for business accts -not an option Not sure if Layer 3 switch is for your first or second suggestion? Would switch go: Modem--->L3 Switch (with VLANS)---->everything attached & no router needed? Any VLAN PC could access networked peripherals? (would be good) – user3418765 Jan 15 '16 at 20:01
  • VLANS would allow you to segment your traffic into two completely different networks. So you would have an actual home network and an actual business network. They would have two different sets of resources. – Nick Young Jan 15 '16 at 21:36
  • If they're separate networks, what's virtual about them? They exist in the switch, rather than having 2 routers? – user3418765 Jan 15 '16 at 22:46

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.