asked on

Want to create completely separate networks from a single broadband line

I do volunteer work for a crisis intervention center and we currently have a single FIOS line that goes into the FIOS router and then is distributed through a switch to the staff workstations. Management wants me to create a completely isolated wireless network for the shelter residents without having to bring in another high speed line, but it is important that there be no way the residents' can get into the other workstations or server that are currently installed not only because they contain confidential information but also because of the danger of virus infection. The primary use of the residents' computers will be to create resumes, search the internet for housing and jobs, etc. Would it be workable to bring the FIOS line from the FIOS router to a switch and then bring two lines out of the switch--one to a wireless router for the residents and the other for the business of the center? If so, would there be any way for the residents to breach the connection?

Chuck

tigermatt

The easiest way I can see of you achieving this is to connect 2 firewall routers from the FIOS router. The routers must be standard routers - not routers which have built-in modems. Each router would then be configured as either the router for the residents' connection (so you would run another switch specifically for that, or a wireless access point) and the other router would then have a direct uplink into the existing network switch to give the servers and workstations Internet connectivity.

Note that if you just want wireless connectivity, there would be no harm in connecting an access point to the FIOS router, then just another router behind the FIOS specifically for the main network. If you don't want the main network to communicate with the residents' network, you need two routers though.

By using separate routers, the residents' PCs cannot connect to the main network, and the main network cannot pass through the firewall to the residents' networks. Both networks are able to pass out through the main router to the Internet. This is obviously the best approach - and since all the cables are connected up differently, you can rest assured that the two networks are physically separated.

The other method to do this with would be to use a VLAN capable switch to split the network into two separate VLANs. Each VLAN would be configured so they cannot communicate to each other - you would then connect an access point to one of the VLAN ports for the residents to access, and leave all the other ports on the other VLAN for the main network. The problem here is that someone could potentially log in to the switch and change the VLAN configuration - which could cause problems since no devices are physically separated.

-tigermatt

caaron

ASKER

So what you're suggesting is that the FIOS router be used as a hub for the two additional routers, if I understand correctly. Then each router would have a different address (the FIOS router is 192.168.1.1) such as 192.168.2.1 for one of them and 192.168.3.1 for the other. And with that setup each series of workstations fed by one router would be isolated from the workstations fed by the other?

Chuck

ASKER CERTIFIED SOLUTION

tigermatt

membership

Create a free account to see this answer

Signing up is free and takes 30 seconds. No credit card required.

See answer

caaron

ASKER

Thanks for the quick and direct responses.

tigermatt

You're very welcome,
Have a good day!
--tigermatt