Isolate Customers Computers from Busness Network Solution

Hi all,

We are shortly moving into a new business premises. We will have a new network.
The Cat5 data ports are supplied by a 24 port Gigabit switch which has a BT Business Hub providing Fibre Broadband to the network.


Most of the data ports will be used for office PC's and printers but two of the Ports are located in the Workshop. The Workshop has an office computer but the workshop is often used to connect customers computers to the internet for repairs via a wired/wireless switch or router.
Many of these computers do not have AntiVirus software and are often 'infected'.

I have limited networking knowledge and I am appealing to the knowledge of the community for the best (simple) way 'isolate' the office computers from the customers computers.

Should I connect the Workshops Office computer to one workshop port that is connected to the main 24port Gigabit switch (for file and printer sharing) and connect customers computers to a wired/wireless switch/router that is connected to the other workshop data port which is connected directly to the BT Business Hub(router) bypassing the 24 port switch and therefore the office network completely. However, if port 2 of the BT Business Hub is connected to the office networks 24 port Switch and Port 4 is connectd to the Workshop switch for customers computers, are the customers computers still 'connected' to the office Pc's or am I overly cautious?
Excuse the poor network sketch ( recommendations for cheap Network Diagram Software gratefuly accepted)

Thanks


Proposed Network Sketch (some Office Pc's and printers not shown)
https://www.dropbox.com/s/4l6vpzn69yc0x8j/Network%20...

BT Business Hub 3 Info -
http://business.bt.com/broadband-and-internet/busine...

BT Business Hub 3 Manuals -
http://btbusiness.custhelp.com/app/answers/detail/c/...

the wireless router in the workshop would have the opportunity of limiting access to external sites only if its firewall or routing tables gave you the required facilities.


Equally if the BT Hub had a "DMZ" option you could allocate a port to that and put the dodgy stuff in the DMZ. I have no idea if it does such a thing.

In general a switch is transparent, unless it's intelligent enough and you use VLANs to segregate traffic. A customer PC on the workshop router could access an office computer via the router if there's nothing configured to stop it.

In reply to a post by Snooz:

.... are the customers computers still 'connected' to the office Pc's

Yes.

The simplest way to do this is to put in another router (A cable router, not and ADSL one).

Connect the WAN side of the new router to the LAN side of the existing network (you will need a new router which will use DCHP to get its WAN address from the existing DHCP server on the existing LAN.)

Connect the customers PCs only to the LAN side of the second router. Any computers connected in this way will be able to see each other and also see the Internet, but not other PCs on the office network.

Job done.

In reply to a post by Sandgrounder:

Connect the WAN side of the new router to the LAN side of the existing network (you will need a new router which will use DCHP to get its WAN address from the existing DHCP server on the existing LAN.)

Connect the customers PCs only to the LAN side of the second router. Any computers connected in this way will be able to see each other and also see the Internet, but not other PCs on the office network.

I have a setup like this and the equivalent of the customers PCs can see the PCs on the same LAN as the router's WAN port - unless I set the firewall to stop them. It's just like accessing the ADSL router from behind the other router. Might be able to subnet it out, but the router will route the traffic from customer PC to office LAN unless told not to.

In reply to a post by yarwell:

In reply to a post by Sandgrounder:

Connect the WAN side of the new router to the LAN side of the existing network (you will need a new router which will use DCHP to get its WAN address from the existing DHCP server on the existing LAN.)

Connect the customers PCs only to the LAN side of the second router. Any computers connected in this way will be able to see each other and also see the Internet, but not other PCs on the office network.

I have a setup like this and the equivalent of the customers PCs can see the PCs on the same LAN as the router's WAN port - unless I set the firewall to stop them. It's just like accessing the ADSL router from behind the other router. Might be able to subnet it out, but the router will route the traffic from customer PC to office LAN unless told not to.

Doesn't work that way with any of my routers. The default is to block the traffic.

The implication of what you say is that with only the one router connected to a Cable Internet modem, then the traffic will be routed out to the Internet.