Quick networking question... LAN to WAN?

[FatalSaviour]

I've been asked to setup a new office for work. Unfortunatley, I'm currently about 200 miles away from where the office is, so it will hopefully just involve me coming down for the day, setting everything up and leaving it be.

There will be a few PCs, a NAS (Thecus N5200) and a printer.

Simple, I thought, and had left the guy who's organised the office to organise getting BT broadband for the office.
However, it turns out that the office is semi-serviced.
The phone line that we have is actually an extension from the main building number.
They also provide broadband in the form of wireless (and possibly wired as well - I'm trying to confirm this at the moment).

Obviously all the PCs need to be able to see each other, as well as the NAS and printer. However, it's paramount that no other PCs in the building that are not in our office are able to see these.

Assuming that the entire building is essentially just on the same LAN (no idea as of yet, the company is pretty useless at providing information), would it be possible to create a small private LAN, by, for instance, connecting the WAN port of a Draytek 2820 to one of the network ports, and then connecting all other PCs off of that?
Would provide enough security, or even work?

If it transpire that there are not any wired ports, I'm guessing that it may be possible to run a wireless bridge using the 2820n. However, can you opt to keep all devices connected on one end of the bridge separate from those on the other?

Hope that all makes sense?

Best Regards,

[Jay]

this is a bit of a nasty setup for you.

You can do this any number of ways, one way would be ICS on Windows server (I wouldn't do it this way though)

Why not have a look into pfSense firewall? This should do everything you need and more.

[Splash]

As Jay says PFSense (or indeed pretty much any commercial grade firewall) can do what you're asking, but I'm guessing you're talking about integrating into structured cabling: if that's the case then you'll need enough switch ports to patch into the structured cabling in the building (assuming that this is possible).

You'll probably find with this sort of things that if they *do* provide structured cabling it all terminates in a cab somewhere. This is pretty much where you need to put your firewall, with your switches hanging off it.

[Moby-Dick]

It possible they might give your office its own vlan , however if its anything like the serviced offices I've worked in / supported their IT usually isn't up to much.

[Jay]

lol

I really doubt they will even probably have managed switches. What I have seen has never been good although we may be suprised!

I expect that you will need to re-run all your own cables. I hate it when you have to intergrate your stuff into other peoples crap! Let us know how you get on.

[bliko]

Connecting the building's ethernet to the wan port of a router will work and do what you want. If you are required to register a mac address, simply do it on a pc first and then clone it's mac address to your router.

If you want devices on the main building network to see servers on your lan you will need to configure port forwarding on your router. Hopefully they will give you a dedicated external ip address for your port so you *shouldnt* encounter any nat issues when people try to access servers on your office network from the internet.

If your connection is wireless then you will need to use an ethernet wireless client (most access points have this functionality) to connect to the wlan and then connect the ethernet port of that to the wan on your router.
Be sure to set the wireless channel of your wifi router different to that of the building's wireless.

You could bridge the two networks wirelessly however this will make your network part of the building's network which is not what you want!

[FatalSaviour]

Originally Posted by Jay

lol

I really doubt they will even probably have managed switches. What I have seen has never been good although we may be suprised!

I expect that you will need to re-run all your own cables. I hate it when you have to intergrate your stuff into other peoples crap! Let us know how you get on.

Managed switches would have been a bit of a pipe-dream I'm afraid! As it turns out, all the network ports across all floors in the building ran down to one switch cupboard that lived in one company's office. For now, I've just attached the secondary WAN port of the Draytek 2820 to a LAN port, and have then run my own wiring along the sides of the office. Internet speeds are somewhat dire (they were slightly better when directly connected to the building's LAN, as opposed to the new private LAN - would there be any good reason for this?) , so I'll be working on trying to get an ADSL line in still if possible.

Thanks once again for your help guys, it's always nice to have people to throw ideas at!

[Jay]

double NAT is probably slowing you down a bit.