[john.kreelman]

Hi all.
Just got myself a copy of server 2003 standard that I want to use for a file server for the home to store films, music, pictures etc. We have four machines in total all running XP SP3 (one is MCE) with limited accounts, no network or file sharing set up and an xbox 360. They all have access to the internet through a D-link 524 and have norton 2008 or AVG free running.

I have a daughter who is 8 and has access to the net along with her friends who use it too. I have done what I can to filter her access but it's always a concern that she'll stumble across some malware that gets past the Norton. My wife & I are (I'd like to think) more net savvy and never open attachments, never ok downloads and only let flash run on trusted sites etc. etc.

Quandary: How on earth can I safe guard the server if my daughters machine gets malware? Is it enough to just not to include her machine on the network. Should I exclude my daughters machine by connecting another router to the main Dlink and have my home net behind that, but then again my daughters machine wouldn't have access to the files on the server (would it?) so defeats the object of a server for her. I'm not sure of the balance of risk here. I back up important stuff monthly to an external drive.

It would be great to have all machines on the LAN but I do not know the balance here between potential risk and convenience as I am new to this. I am going to research it all, but for mo I'm new to this and need some hints to point me in the correct direction.

Many thanks in anticipation.

[lunarlander]

Since your daughter's machine has a higher risk of getting malware, you should separate her machine from the rest of the LAN. You can use the 2nd router arrangement as you described, or use a software firewall on the server to block her machine.

[john.kreelman]

Thanks LL, any suggestions on the software firewall? Is it something like Windows defender or maybe even the standard firewall thats inbuilt. Or would you say thank a third party is better, AVG free 8 for instance.

Ta

[lunarlander]

Windows Defender and AVG Free 8 are not firewalls, they are anti-spyware and anti-virus, respectively. I would try Zonealarm or Comodo. Both have free versions. Then you can put in a 'deny' rule like 'deny source daughter's-ip-address destination server's-ip-address' on that firewall. Firewall rules generally allow you to specify a 'deny' or 'allow' for any tcpip packet travelling through the wire. And you give a source address and a destination address, Also you can specify tcp or udp ports, which would be 'any' in this case.

[john.kreelman]

Great stuff. I'll get tinkering. Many thanks.