Home / server / Questions / 397950
Accepted
Valter Silva
Asked: 2012-06-13 07:33:58 +0800 CST

How to create a separated network to customers only?

  • 772

I work in a company where we have a network ethernet and wi-fi, we would like to create a network where our customers could access our network but don't have access to our computer network.

This access would be internet only, nothing more. The customers will not see our computers and the files that we share in our network.

I have two routers, how can I do this ?

A Cisco Linksys Wireless-N Broadband Router WRT160N V3 and a Netgear Wireless G Router WGR614 v9 and about firewalls there´s only windows firewalls in each computer by default.

router hardware networking wifi ethernet

2 Answers

  1. Best Answer

    You can separate the networks yourself on the Cisco/Linksys router. I did this myself on almost the exact same model for a friend's office. You should consult the documentation for exact details on how (I don't remember offhand, most of it was just through the WebGUI), but here's the general idea:

    1. Create 2 VLANs on the Cisco router. One is going to be for your internal network, and the other is for the customer network.
    2. Create 2 SSIDs, again one for internal computers and one for customer access. Assign these to the VLANs you created above
    3. Configure an access list to deny access between the customer network and the internal network.
    4. (Optional) Configure ports on the router to be for the internal or client VLAN as needed
    5. (Optional) Enable client isolation for the customer wi-fi network. This makes it so that they cannot communicate with each other, only access the Internet.

    At the end, you should have two networks, say 192.168.100.0 for internal computers and 192.168.200.0 for visiting customers. The customers will be able to get on and see Facebook, but NOT ping or otherwise access the 192.168.100.0 network. Your internal network should continue to function normally.

    • 4

  2. Out of the box, I don't believe you can do this with either of your routers - both of these are consumer grade and don't have any support for DMZ or VLANs. You might be able to flash one of the routers to use different firmware with this functionality, but I would not risk this in a commercial environment - get it wrong and you risk your customers credit card details being leaked and going out of business from the shame.

    Invest in a router that supports VLANs or has a DMZ port. My experience is with Cisco ASA 5505 which will do this, and give you a pretty robust firewall and a VPN allowing your staff remote access all in the same box. They cost about £250 - $400. There may be simpler and cheaper options out there - the ASA isn't that hard though - @Hyppy describes what you need to do.

    • 1