Isolate computers on a LAN

I have a LAN and we need to expand it by creating a public
computer lab. I want to keep the public wireless computer
lab isolated from the rest of the LAN for security reasons.
Meaning I want to make it so someone at a computer in
the public lab cannot access any computers or printers on
the rest of our LAN. How best should I do this? They computers in the computer lab need to be able to access the internet.

 

The normal way to accomplish this would be with a couple routers and some ACL's.

The internet connection itself comes into a router, which splits it to the wireless network and then one to the lan. Usually both the wireless network and the lan will also have a router. All you'd do, is go on to the main router and configure the ACL's so that traffic from the computer lab cannot go to the wireless network. Just put in some denies on the respective ip's or ports.

Of course if you're working with a cheap router you won't be able to do it like this.

 

Depending on the swtich you have, the bets wya to do this is creat a VLAN, Virtual Lan. You setup Vlans by number Vlan1, Vlan2, Vlan3 etc. You can have seperate Vlans for each area. Vlan2 = LAN, Vlan3 = Lab etc. Anyone connected to the Lab Vlan cannot access Vlan2 and so on...

 

Easiest and most secure = firewall

This could be a router with a built in firewall (more than just NAT), or a linux machine (or similar) acting at a firewall.

Scott
http://www.AAApcMechanic.com