Networks

Ask something
Question Locked

Segment network

0 helpful
5 replies

by megtek

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.
Hi. I have 1 public static IP address coming into my office. I have a DSL modem - with a Linksys BEFSX41 router for my internal network. Attached to that router I have a WIRELESS Linksys WRT54GX4 router. I have that set up on my internal network. When connected to this wireless, people have access to the file server(s) and the printers. I want to add an additional wireless router - Linksys BEFW11S4 v.3. I want to segment the network and have the BEFw11S4 router configured to ONLY get internet access, but block access to the LAN printers and servers. Can someone help me with the configuration for that?

5 replies

by bcpgm

Install the new wireless router between the DSL modem and BEFSX41 router.
The internal network with BEFw11S4 will be blocked to those with BEFSX41 or WRT54GX4.
This is because you can define only one gateway, which is the router before it.

by cg it

since your Wireless Linksys router creates a broadcast domain, any users on the BEFSX41 router is in a seperate broadcast domain. Adding an additional router creates yet another broadcast domain.

you can't have the bef2114 router only getting internet access with the other 2 routers in the mix. Any users on those segments will also get internet access as those routers act as the gateways out [2 hops to get out [from the BEFWw11 to the WRT54 to the BEFSX].

Any computers connected to either the BEFSX or the WRT54 will not be able to access comps on the BEF211 by virtue of the built in firewall on the router and by NAT. If you configure the deny internet access schedule on either the BEFSX or WRT54, then no users on the BEFW11 will get out [see the hop gateway out].

A better course of action than buying another router would be to secure the WRT54G wireless router so that only those computers you specify can access the network from that router and then secure the file servers and printers with share permission and/or NTFS permissions. That way your assured that no one but those computers you authorize and only those users with permissions can access reourses you want to have secure.

by mgp2

I believe his goal is that anyone attaching wirelessly to the BEFw11S4 will only be able to access the internet (basically a "Guest" access point), while hosts attached to the other two routers (his LAN) would have internet access as well as access to his internal network resources.

by mgp2

Depending on how many clients need IP addresses on your LAN, you could do it two ways. First, you can create 3 subnets, all with the same subnet mask (thus, each allowing the same number of clients to attach), but I'll assume your intent isn't to split your network into 3 equal sets of hosts. On the other hand, I'm assuming the "guest" wireless AP wouldn't need more than a few IP addresses at any given time, so you could use VLSM and subnet the guest AP (as well as your other wireless router) each with their own subnet range with a mask of 255.255.255.228 (14 hosts each), and then give a larger subnet (255.255.255.192 for 64 hosts) for your wired clients. Check out the link below for the VLSM chart.

http://bisontech.gfps.k12.mt.us/cisco/VLSM_chart.jpg

Good luck!

This discussion is closed to new replies.