[SOLVED] Simple network protection!

salvor_hardin · 05-12-2009, 03:25 AM

Network has 20 computers. One of them is Linux application/sql server. Network has several media converters, 7 unmanaged switchs and one router. Router has exit to Internet through VPN network connected to other branch office in 300km away. Router is managed by ISP and nobody else has access to it. All computers are in single WORKGROUP. Half of them have internet access and the other half has gateway address removed so that they cannot go to Internet. But since they are all in single network there is always a possibility that **** can spread all over the network. I need instructions on how to protect all of the network behind router without router configuration. Or how to protect only chosen workstations in my network workgroup. I want to do it without installing firewall on every single computer. Is it possible to do it on a WORKGROUP level by not implementing any of additional hardware! Is there any software that can manage that?

**lorjack** · 05-12-2009, 09:48 AM

You will have to add some kind of hardware or software to protect them. The easiest thing to do would be to buy hardware firewall and connect it directly behind the router. What OS are these computers running? You can use the windows firewall.

Basenge · 05-12-2009, 09:49 AM

Setup LAN IP ranges with specific workgroups or Domain and configure out the PCS supposed to get internet.

grue155 · 05-12-2009, 08:43 PM

A fairly simple solution would be to use a typical consumer model NAT/router in front of 3 to 5 machines (or however many ports the NAT/router has). That would divide your LAN into protected islands. If one island needs to talk to another island, then the NAT/router would need to have a static route capability (the low end consumer stuff usually can't do this), and you'd need to forward ports at NAT box on the other island.

You could probably borrow two NAT/routers, and test the idea out to see how it works.

salvor_hardin · 05-13-2009, 02:24 AM

I know that putting a hardware firewall behind a router would be the best solution...but I was thinking without any hardware addons. Well, I will think about this...

05-12-2009, 03:25 AM	#1 (permalink)
salvor_hardin Registered User Join Date: May 2009 Location: Zadar, Croatia Posts: 20 OS: XP, Ubuntu	[SOLVED] Simple network protection! Network has 20 computers. One of them is Linux application/sql server. Network has several media converters, 7 unmanaged switchs and one router. Router has exit to Internet through VPN network connected to other branch office in 300km away. Router is managed by ISP and nobody else has access to it. All computers are in single WORKGROUP. Half of them have internet access and the other half has gateway address removed so that they cannot go to Internet. But since they are all in single network there is always a possibility that **** can spread all over the network. I need instructions on how to protect all of the network behind router without router configuration. Or how to protect only chosen workstations in my network workgroup. I want to do it without installing firewall on every single computer. Is it possible to do it on a WORKGROUP level by not implementing any of additional hardware! Is there any software that can manage that?

05-12-2009, 09:48 AM	#2 (permalink)
lorjack TSF Enthusiast Join Date: Nov 2007 Location: Planet Earth Posts: 2,209 OS: Windows 2K, XP Pro sp3, Windows Vista, Windows 7, Ubuntu	Re: Simple network protection! You will have to add some kind of hardware or software to protect them. The easiest thing to do would be to buy hardware firewall and connect it directly behind the router. What OS are these computers running? You can use the windows firewall. __________________ Those who can't write, write manuals. Don't trouble trouble until trouble troubles you...

05-12-2009, 09:49 AM	#3 (permalink)
Basenge Registered User Join Date: May 2009 Location: East Africa Posts: 20 OS: xp service park 2	Re: Simple network protection! Setup LAN IP ranges with specific workgroups or Domain and configure out the PCS supposed to get internet.

05-12-2009, 08:43 PM	#4 (permalink)
grue155 Registered User Join Date: May 2008 Posts: 240 OS: LAN Herder	Re: Simple network protection! A fairly simple solution would be to use a typical consumer model NAT/router in front of 3 to 5 machines (or however many ports the NAT/router has). That would divide your LAN into protected islands. If one island needs to talk to another island, then the NAT/router would need to have a static route capability (the low end consumer stuff usually can't do this), and you'd need to forward ports at NAT box on the other island. You could probably borrow two NAT/routers, and test the idea out to see how it works.

05-13-2009, 02:24 AM	#5 (permalink)
salvor_hardin Registered User Join Date: May 2009 Location: Zadar, Croatia Posts: 20 OS: XP, Ubuntu	Re: Simple network protection! I know that putting a hardware firewall behind a router would be the best solution...but I was thinking without any hardware addons. Well, I will think about this...