Retail Computer Store Network Setup

[RCD_Technology_Solutions]

Good morning all.

I recently purchased a small computer repair shop and slowly making changes as I see fit to better support the local customers.

The network is a simple 192.168.0.x flat hanging off a cable modem. One of my worries is that if a customers PC is virus infected it could spread unknowingly, Another is if a PC has some type of LogMeIn, teamviewer installed and the PC is on over night, the PCs owner could try to remote connect and see what else is on the network... I know too paranoid.

Currently we have several "Shop" pcs for connecting customers hard drives to backup and scan for viruses....

My thought is to have a sonicwall-ish device (Or even Untangle) with a DMZ and LAN on 2 different networks throughout the store running on seperate networks. Use 192.168.0.x for the store pc, shop pcs, NAS and printer, and 172.16.0.1 for the "DMZ" on seperate switches for the customers PCs to connect to the internet and scanning.

Thoughts? Too Paranoid....?

Thanks Bob

 

[acscva]

When I had a retail store we had a sonicwall and seperated the techroom bench pc's from our network as there are too many possibilities for a virus to spread through the network. Also it is important not to be able to see other PC's that they have on the bench that could also infect each other.

 

[frederick]

From our modem, it goes into a MikroTik, The MikroTik is plugged into a Switch that leads to the benchs. Incase a computer doesn't have an ethernet jack, the MikroTik is broadcasting a WiFi as well. A SonicWall is also plugged in the MikroTik that leads to our switch and AP.

 

[YeOldeStonecat]

My thought is to have a sonicwall-ish device (Or even Untangle) with a DMZ and LAN on 2 different networks throughout the store running on seperate networks. Use 192.168.0.x for the store pc, shop pcs, NAS and printer, and 172.16.0.1 for the "DMZ" on seperate switches for the customers PCs to connect to the internet and scanning.

Thoughts? Too Paranoid....?

Thanks Bob

I don't call that paranoid at all, matter of fact..common sense.

Service area separated from the rest, that's smart...keeps infected computers from spreading their disease to your stuff, and other clients computers.

 

[ArtemusComputerTechnology]

When I had a retail store we had a sonicwall and seperated the techroom bench pc's from our network as there are too many possibilities for a virus to spread through the network. Also it is important not to be able to see other PC's that they have on the bench that could also infect each other.

My shop's setup is pretty similiar to acscva. I have a separate network for the bench computers\laptops then my own network of my work computers\laptops\servers.

 

[RCD_Technology_Solutions]

My shop's setup is pretty similiar to acscva. I have a separate network for the bench computers\laptops then my own network of my work computers\laptops\servers.

Thanks for the suggestions...

I just want to confirm that it is 2 different physical networks, not 2 seperate IP ranges riding on the same physical lan...

thanks
Bob

 

[YeOldeStonecat]

With todays cost effective managed switches, you can easily and securely do this with VLANs that the switch manages. Heck you can even do it on the cheap with cheapy unmanaged switches and an old Stinksys routers with DD-WRT firmware....and do port based VLANs on the 4 port switch. Port 1 uplinks to a switch which leads to your office network, port 2 with second VLAN uplinks to a switch for your service bench. Keeps it simple..same IP range, same physical network.

 

[RCD_Technology_Solutions]

With todays cost effective managed switches, you can easily and securely do this with VLANs that the switch manages. Heck you can even do it on the cheap with cheapy unmanaged switches and an old Stinksys routers with DD-WRT firmware....and do port based VLANs on the 4 port switch. Port 1 uplinks to a switch which leads to your office network, port 2 with second VLAN uplinks to a switch for your service bench. Keeps it simple..same IP range, same physical network.

Great Advice,

Many Thanks....