Re:Ask HN: small office network
by run4yourlives on Monday November 17, 2008 @06:43PM
(#367547)
There is a lot in this post to digest.
Some questions: What kind of equipment do you have here? Home stuff? Commercial Grade?
What does your external server do?
To be honest, I'd keep it dead simple, especially if you are using home grade stuff like linksys. Switches don't do DHCP, but routers can. Think of switches basically as giant line splitters.
Your front door is the wireless router - firewall on (assuming it's a full router, not just an AP), DCHP with your DMZ behind that, use 192.168.1.1 or whatever, and then your internal router is 192.168.1.2 on this network.
Second firewall/router to your internal network, DHCP on. You can actually use the same addys as the other network, but it may make sense to use different ranges. Switch behind here if you need it.
Ports open on both firewalls as required. That's how you see your DMZ server. (Don't use the "DMZ host" crap on the routers if it has such a thing, you're setting up a real DMZ manually.)
All wireless access should receive a different (untrusted in your DMZ) range from the first DHCP.
If you can't see the internal server from a laptop with wireless, you're doing thing right. If you can, you are open.
Under no circumstances should you allow wireless internet access to be granted access to your internal network without VPN.
>>>>>>>>>>>>>
The really simple way though is just to use the wired router with every port closed and expose as required. Throw the Wireless router outside of that with the internet attached to it. It depends though on what that external server is doing. I wouldn't do this for web, but if it's just mail I might.
Some questions: What kind of equipment do you have here? Home stuff? Commercial Grade?
What does your external server do?
To be honest, I'd keep it dead simple, especially if you are using home grade stuff like linksys. Switches don't do DHCP, but routers can. Think of switches basically as giant line splitters.
Your front door is the wireless router - firewall on (assuming it's a full router, not just an AP), DCHP with your DMZ behind that, use 192.168.1.1 or whatever, and then your internal router is 192.168.1.2 on this network.
Second firewall/router to your internal network, DHCP on. You can actually use the same addys as the other network, but it may make sense to use different ranges. Switch behind here if you need it.
Ports open on both firewalls as required. That's how you see your DMZ server. (Don't use the "DMZ host" crap on the routers if it has such a thing, you're setting up a real DMZ manually.)
All wireless access should receive a different (untrusted in your DMZ) range from the first DHCP.
If you can't see the internal server from a laptop with wireless, you're doing thing right. If you can, you are open.
Under no circumstances should you allow wireless internet access to be granted access to your internal network without VPN.
>>>>>>>>>>>>>
The really simple way though is just to use the wired router with every port closed and expose as required. Throw the Wireless router outside of that with the internet attached to it. It depends though on what that external server is doing. I wouldn't do this for web, but if it's just mail I might.