IT Employment

Ask something
Discussion Locked

sharing cable modem without sharing file

0 helpful
17 replies

by dewey8315

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.
Just got a cable modem installed in my office which is right next to two other businesses. We want to share the cost of the broadband by sharing the internet. There are 4 computers in one business, two in another and two in the third. How can we setthis up to share the broadband but not share our files on our separate networks? All the businesses are on networks and need to share files between themselves, but we do not want to share anything other then the broadband between each business. All computers are running windows 98 or greater. The cat 5 cable is already installed connecting all three business. Thank You

17 replies

by omie

Before you do or plan that I think check first your contract with the cable company. You might be violating the terms of agreement if you share that internet connection especially it will be shared with other business entity. In legal terms you are acting as an ISP to the other business entity and the penalty is stiff considering cable companies are protected by federal law.

by thechas

I do agree that you need to closely look over the service agreement with the Cable ISP before you proceed. The Cable companies even frown on sharing between multiple PCs in a home.

Another thing to think about, is do any of you need to upload a lot of data?
If so, the Cable route may not do the job at all.
You need IDSN, T1, or SDSL if you need to upload large amounts of data.

There is no way to share the modem without inter-connecting your networks.

You can connect the modem to a router, and connect from the router to each network.
I would install a hardware firewall between each network and the router.
At a minimum, that would restrict hackers from gaining access to all networks once they got into 1.
With 3 different firmssharing a common connection, security IS going to become a concern at some point.

To protect all parties, you need to seriously look into some form of written agreement as to liabilities and responsibilities.

If one of the other firms get hacked, you can bet that they will blame you for it.

Another thing to consider is the number of users.
If you end up with 30 users connected, your 1.5M bandwidth suddenly acts like 52K for each user.

Chas

by armourbl

And you will probably need to upgrade the operating systems to Win 2000 or XP Pro so you can use NTFS to secure the file structure on each computer. A software firewall on each system may not be a bad investment either.

But, like he said, every additional computer sharing the same IP (router will have the static IP for all out bound traffic) you are going to suffer on the bandwidth.

Cable? Are these businesses that poor. If they can't afford a T1, etc., they should at least be able to afford a Cable connection of their own. We are talking $50-$80 a month tops for the service.

ben

by lordinfidel

Security domains has nothing to do with IP.

All because I am on the same subnet as someone, does not mean I have automatic access to their systems.

It just means that I share the same subnet.

And all because you are on the same physical segment, does not mean you have to be on the same IP subnet.

The router can be set up with 2 IP adresses on the same physical segment.

It can have 2 subnets, 192.168.1.0/24 and 192.168.2.0/24

and have the .1 adress assigned to it. Then traffic is segmented via IP. You can even take an existing class c 192.168.1.0 and seperate it into half, 192.168.1.0/25 and 192.168.1.128/25

The IP's on the router would then be .1 and .129.

But..... The concession I will make with regards to access to files if all systems share both the same physical segment and the same IP subnet, is packet sniffing off of the wire. While they won't have direct access to the files, they can sniff the packets that go across the wire and get data that way.

by armourbl

Didn't mean to imply that they couldn't have more than one IP, just that most likely the Cable ISP is only going to allow for one IP to be recognized. I don't really know a lot on the subject, so I shouldn't have even tried to explain.

What Lord said is correct. I just don't have the network experience to call it from memory and explain like he did.

Still, it doesn't change the fact that they really shouldn't need to share a cable connection.

ben

by dewey8315

I appreciate the non-lawyerly answer but, I am not a networking expert. Just your plain white user. Could you give me an answer that I could maybe understand a little easier. I know it can not be that hard,,, but your response was a little hard for me to end up knowing exactly what to do... Thank You again..

by omie

I was reading your explaination that you could configure the LAN side of router to two subnet. I look at the configuration of low end router and it is imposible to realize that. Unless you have a DMZ on the router. Again two won't be enough to separate those three entities.

For security is definitely an issue. As mentioned there WIN98 WS and it looks like they will be setup as workgroup.Although they will be setup separately by different workgroup name still there are a lot of sniffing toolsand password recovering scripts. Again trust is needed to join this 3 entities.

Again this considered a federal offense (cable fraud/theft) and again don't risk the companies future with pennies and dime. It would only take one disgruntled employee to squeal and it will lead to their downfall including who the individual who set it up.

by thechas

If I under stand Lord Infidel correctly, you can have a reasonable degree of security for your files if you install a "REAL" router, and not a "Best Buy" grade 'home' cable router.

Since you admit to not knowing networking, (good for you by the way) you will need to have the equipment setup and installed by a local IT tech.

The intricacies and issues that will come up can take days to research if you are not familiar with the protocols and equipment.

Chas

by lordinfidel

Sometimes I forget that everyone on this board are not all techincal. So I apologize for the aloof comments.

The dumbed down version.

All because the systems use the same outbound connection, does not automatically mean that they have access to each others files.

It is difficult for me to give you a step by step, blow by blow of what to do.

But if your goal is to make sure that one business can not even see the other business' systems. You will need to get someone in there who understands routing and subnetting principles.

If you don't care if they can see each others computers but only care if they can access files. Simply make sure that each person's system has a unique username and password, and the default administrator account has a unique password assigned to it. (that was for nt,2k,xp)

For 98, just don't enable file and print sharing.

by lordinfidel

If the router you have is so archane that it can not do basic subnetting.

BTW- a cable/dsl modem is not a router.

A DMZ has nothing to do with anything in this case.

This is a very simple configuration. The rules of IP forwarding prohibit 2 computers located on 2 different subnets to talk to each other unless there is an intermediary device that will forward the requests. This rule can not be broken no matter how hard you try.

I can have 10 computers connected to the same physicalswitch. And each system resides on it's own little subnet. And no packet sniffer in the world will see the traffic.

For a more precise example. Take these IP's
192.168.1.1/24
192.168.2.1/24
192.168.3.1/24
192.168.4.1/24
192.168.5.1/24
192.168.6.1/24
192.168.7.1/24

Not a single one of these IP's can talk to each other without a router connecting them and forwarding the requests.

I'm not trying to be an dick, but out of all of the people to correct on routing and security principles, I should be one of the very last.

by omie

First of all I am not challenging your knowhow...
In your sample IP you're right if your SM is 255.255.255.0 and 255.255.255.192 but in the case of 255.255.0.0 it will be open. Another question is about the DG ... is it not as a rule the DG should belong to the same subnet ? I know the difference between the cable/dsl modem, switch and a router. If they are using a cable most likely they have a dynamic IP on the WAN and some low end router could act as a DHCP server or it could be disabled and assign static IP addresses on all WS. In order for a PC to browse or connect to internet a DNS and DG must be assigned properly. With that in mind and in your sample what would be the right Default Gateway (DG) address and Subnet Mask (SM)?

by lordinfidel

The router will need to have an IP address assigned to it from each subnet.

In my example the subnet mask is a /25 for both subnets. Which is 255.255.255.128

I know it seems counter intuitive, but this is how it works:

You have a class c 192.168.1.0 . You can break that down into 2 subnets. So the newtork ID's would be; 192.168.1.0 and 192.168.1.128

That means that the .0 and .128 IP's can not be used. And the .127 and .255 address are used for broadcast address.

So that leaves these 2 ranges.

SubnetA: 192.168.1.1-126/25 or 255.255.255.128
SubnetB: 192.168.1.129-254/25 or 255.255.255.128

The standard is to assign the 1st IP in the subnet for the border router of the outer most network. Which in most cases forsmall netwks is the rtr/firewall. In most larger netwks it would be the firewall which then passes packets out to the router. In some instances it will be the proxy server.

So the router in this case would sit on 2 subnets and have the following IP's assigned to it's LAN interface.

SubnetA: 192.168.1.1/25
SubnetB: 192.168.1.129/25

Now any systems on subnet A, would have gtw of .1
and subnet B would be .129

It's really that simple

by lordinfidel

Yes, read your contract. Make sure you are not prohibited from routing multiple connections thru your service.

Now for the reality of NAT and networking.

It is not easily detectable for any ISP to tell if you are running multiple computers behind a single IP. All requests outbound appear to come from the same IP.

There are only 2 ways to tell. 1- you tell them, and 2- multiple systems go to one of their sites that log not only the IP and time, but the system name. Then they have tochug thru their logs and put 2 to 2 together.

There is no such thing as a troller that magically counts the amount of systems on your network. That is the beauty of NAT. It by default hides the internal makeup of your network.

by djent

I have done this for a number of customers on cable, DSL and ISDN. I fed output from the modem to each office suite into thier own router which provides isolation from other clients. You may need a hub or switch at the modem to provide enough ports.

by smckay1128

Is it really worth all the hassle? Your comment in a future post "I know it can not be that hard" really explains the futility of your trying to do it at all. It is one thing to share internet access with your kids and spouse at home, but to share something as crucial to business intelligence integrity as a common internet access point with two other businesses is cooperate suicide. If I was a customer of yours, and I found out you were that loose with proprietary intelligence, I wouldn't be a customer for long, and I wouldn't hesitate to tell anyone who would listen how irresponsible you and the two other businesses were.
As it is apparent neither you nor your "partners" employ the expertise to do this properly, let along monitor it to insure intelligence integrity, may I suggest you go it alone.

by cool1217_2000

You should have permission from the Cable Net provider for that. One thing can be done just download an proxy tool and install it on the PC on which you have the connection. Just distribute it from there. There are tools like Naviscope you can get it from download.com . You have to set the port number and also can block a particular PC in network. BUT, you will have to keep the PC always ON when anyone needs an access. No matter if its Win98, NT, 2000. But not with Linux.

by samuelbrooks

I use three different cable companies for connecting SOHO users and every one of them stipulate that you cannot resell or share access with anyone else.

That being the case:

Buy three NAT boxes, about $100 each.

Wan on Box 1 connect to Internet
192.168.1.1
Setup DHCP

Wan on Box 2 connects to one of Lan ports from Box 1
Setup Wan for Automatic
Setup DHCP
Connect Office One computers to LAN ports

Wan on Box 3 connects to one of Lan ports from Box 1
Setup WAN for automatic
Setup DHCP
Connect Office Two computers to LAN ports

This way only traffic destined to the Internet is visable to each other. But Box 2 & Box 3 in each of the different users offices so they do not have access to each others traffic to sniff.

If you are worried about the Internet traffic being sniffed you should not have an Internet connection because it will be watched by some one so don't worry about your neighor, concentrate on being a safe Internet user.

The above solution will cause issues with some game and IRC but should work for most issues.

I recommend you each get your own Internet connection. I would also check into DSL if available due to better upload speeds. Also the price is less then Cable Modem for business use. Also check from multiple sources not just your phone company for DSL. It is distance limited based on the Central Office equipment that has been installed. I have seen where DSL is not available from the local Telco but a third party has it available.

Just remember that because something can be done, does not mean it should be done.

Good Luck.

This discussion is closed to new replies.