Join Log in
Score:1
Dark Corner avatar Server

Tips for managing safe and insecure PC mixes

cn flag
Dark Corner

There are two buildings connected by an optical fiber, each with 3-10 PCs but in a mix of PCs used in a business context and some in homes. Unfortunately, when the network was designed years ago, no one took steps to keep the two environments separate.

Building A
There are servers, printers, work PCs, guest PCs, personal smartphones.
Here is also the only Internet connection used by both buildings.
It was solved with a firewall (pfsense) separating the office LAN and a network segment with a different Access Point for smartphones and guest PCs. There are two DHCPs to keep the two networks separate.
I would like guests to be able to use the working printers on the LAN and I don't know if a rule in the firewall will suffice.

Building B
Here, too, there are printers, work PCs, smartphones and guest PCs.
Here there are also homes with personal PCs, xBoxes, SmartTVs, etc.
Only the DHCP of the LAN in Building A is used
So with more security problems and therefore I need to separate the three environments (works, guests and homes) without modifying the network cabling.
I don't know if it is enough to create VLANs, in any case to connect to the Internet or to the servers in Building A the traffic must always pass through the single fiber.
It must also be taken into account that we have no management possibilities in the houses. There is a network point, but we don't know how it will be used; therefore the check must take place upstream of the network point.
Here, however, I could mount a second pfsense firewall.

Thanks in advance for any advice.

39
0 + 0
djdomi avatar
za flag
djdomi
vlans are a good starting point and imho a good start specifically when the printer should be used from both sides
1
Reply
anx avatar
fr flag
anx
This may be more of a [security](https://security.stackexchange.com/help/on-topic) than a system management problem - In any case, you need to more clearly specify the *goals* of your rearchitecturing work - do you just need to ensure that unmanaged devices can less easily saturate your link (reliability)? Or do you suspect that some work PCs are setup in a manner where they derive trust from the untrusted network topology (then that should be fixed first, with measures to limit untrusted machines ability to send spoofed traffic being strictly secondary).
2
Reply
Dark Corner avatar
cn flag
Dark Corner
As I said, I don't have control over personal PCs and smartphones. In Building A I can limit access via a dedicated Access Point. But in Building B I have no control and therefore I cannot know if, at his home, an employee on his personal PC is downloading a file with a virus or if his son is trying to enter the corporate NAS using his father's password . It seems ridiculous to talk about this, but today this is the network configuration and first I have to segment the physical network so that only the internet access is free and everything else is confined within that network segment.
0
Reply
Score:2
Ron Trunk avatar Server
in flag
Ron Trunk

I'll assume that all the PCs and printers are connected to managed switches that are VLAN-capable. If that is not the case, there is little you can do until you change that.

At each site, create three VLANs: Work, Home and Guest. Trunk the 3 VLANs across the fiber link and to the firewall, so the firewall is the default gateway for each VLAN.

You can then assign each port to the correct VLAN, depending on the type of device on that port.

Now you can create policies on the firewall to isolate each VLAN. As a start, I suggest you allow all VLANs to reach the Internet, but don't allow devices in one VLAN to reach another. That way, you can keep home and business devices separate.

0 + 0
ธงชาติไทย
Elon Musk
I sit in a Tesla and translated this thread with Ai:

mangohost

Post an answer

Most people don’t grasp that asking a lot of questions unlocks learning and improves interpersonal bonding. In Alison’s studies, for example, though people could accurately recall how many questions had been asked in their conversations, they didn’t intuit the link between questions and liking. Across four studies, in which participants were engaged in conversations themselves or read transcripts of others’ conversations, people tended not to realize that question asking would influence—or had influenced—the level of amity between the conversationalists.