[memevertical]

Hi Everyone.

I own a Computer Support Shop. I'm always Re-installing Windows, and downloading neccessary drivers for each client, but, I know that there are Viruses that can spread through the network.

And every computer I fix here, connects to the internet to install updates, but I want to know how can I give access to that computer to the internet, but not to the other computers.

I know that one fix could be Firewalls and stuff, but still, I wish that computers could be in totally seperate Networks. And some computer that are part of different workgroups can still see each other.

Any ideas?

Thanks everyone.

[cwwozniak]

Assuming you are now using some kind of router to connected to a broadband modem, you could insert a second router between the existing router and the broadband modem. Any untrusted computers would connect to this new router and would not be able to see any of the computers connected through the original router (unless you set up specific port forwarding on the original router).

[memevertical]

Oh ok, so you're saying that Untrusted computers will conect to the closest router to the modem. And they can only see computers that are connected to that same router, but not the other router?

Are you sure that when Computers get IP addresses, even if they are on different routers, they wont consider them selves to be part of the same network, and there for see each other?

Thanks a lot for your answer.

[cwwozniak]

We have a setup at work where all internal computers and server connect to one router via a 24 port switch. The IP address range is 192.168.0.1 (router's address) through 192.168.0.255.

The WAN/Internet port of that router has fixed IP address of 192.168.1.2 . The WAN/Internet port connects to the LAN port of a second router. The IP address range of the LAN ports on that second router is 192.168.1.1 (router's address) through 192.168.1.255. The WAN port on that router is set to our static public IP address and connected to our high speed cable modem.

That second router is set put 192.168.1.2 in its DMZ zone. This will pass all traffic that is not NATed to another LAN port, to go to out internal LAN router. We have several LAN based security cameras connected to the second router. These cameras can be viewed from both the LAN and Internet. That second router also has a WEP encrypted WiFi Access Point. The WEP key is not too long and not too difficult for a visitor to enter into their laptop. We also have one Network jack in the conference room connected to a LAN port on the second router. The router has DHCP enabled for a small range addresses. This gives visitors full wired or wireless internet access but they can not see any of the computers or server on the internal LAN.

NOTE: A static public IP address is not needed for this to work. We only have it to simplify a VPN connection that few people need to their desktop PCs while out of the office.

[lunarlander]

You have to understand how ip addresses and subnet masks work.