Need help linking two networks

[DanielBrazil]

Hi,

I need to link two separate networks, but only one of them must "see" the other one. Let me explain.

I'll call my first network "SAFENET". It's connected to the internet (regular router w/ DSL) and it has two IP cameras and one NVR connected to it (through a Cisco Sf302-08p, cause there's not enough ports on the router). The NVR sends the images from the cameras to my cellphone wherever I go, through the internet.

Then there's another network that I'll call "OPENLAN". It doesn't have internet access, it's just a regular LAN, but there's a LOT of users connected to it. Also, there are two IP cameras on this network that I need to connect to my NVR, so I could access them on the go as well (and also record the images).

The problem is, while I need those two OPENLAN cameras to be seen by my NVR on SAFENET, I can't give OPENLAN users full access to the SAFENET network, not even to the NVR, otherwise I would have countless strangers using my internet connection and having free access to my NVR, which would ruin my private network safety.

So, is there a way that I could have SAFENET devices to "see" OPENLAN devices through the Cisco switch, while blocking OPENLAN from accessing SAFENET devices?

In my head, this could be solved by giving the Cisco Switch one IP address on the SAFENET network (i.e. 192.168.0.7) and one IP address on the OPENLAN (i.e. 192.168.1.7), and then figuring out a way to either port-forward the cameras from OPENLAN to SAFENET (so when my NVR connects to cisco 192.168.0.7:3333 it would actually connect to the IP camera on OPENLAN); OR giving SAFENET full access to the OPENLAN devices through Cisco, while OPENLAN clients would see any request as coming from the Cisco (therefore, they wouldn't have access to SAFENET at all). The second solution would be the best for me.

Does anybody know how to do this? This is so beyond my capabilities.

Note: SAFENET Router has only one WAN port, and it's connected to DSL. I only have access to a regular (client) port on the OPENLAN.

A made a drawing to illustrate the current configuration.

I appreciate any help in advance.

Best regards,

Daniel.

[johnd2310]

Hi,

You will need a firewall to achieve your requirements. On the firewall you will create two zones, "SAFENET" and "OPENLAN".. You will then create  rules to allow only  "SAFENET" zone to initiate connections to "OPENLAN" and block "OPENLAN" from initiating connections to "SAFENET"

There are a number of firewall devices you can get depending on your budget. Let us know if you need help choosing the firewall

Thanks

John

[DanielBrazil]

Thanks for the reply, John. I can't get a firewall right know though.

Maybe I can have SAFENET on Uplink 1 (with the Switch being its client with IP 192.168.1.5) and OPENLAN on Uplink 2 (the Switch as client with IP 192.168.0.5), then set DHCP on ports 1-8, so Switch clients would get IP 192.168.2.x, and the default gateway would be the Switch itself with IP 192.168.2.1.

Then the default route for 192.168.2.x clients would be Uplink 1 (where the internet is), with a static route to 192.168.0.x (OPENLAN range), to Uplink 2.

Is that possible using only the Cisco Sf302-08p switch?

Thanks!

[johnd2310]

Hi,

It is not possible with a switch to  achieve your objectives. You need a firewall type device to achieve segregation of your network. If you cannot buy a firewall, you can use a open source firewalls.

Thanks

John

[paul driver]

Hello

---

@johnd2310 wrote:

Hi,

It is not possible with a switch to  achieve your objectives. You need a firewall type device to achieve segregation of your network. If you cannot buy a firewall, you can use a open source firewalls.

Thanks

John

---

@johnd2310 I tend to disagree that this isn't possible, It is possible to segregate two networks from a switch however in this case it might not be with THAT with that type of switch

[paul driver]

Hello 
Do you have access to that openlan router?

One possible way depending on the feature sets of the router, Attach openlan rtr to the cisco switch then create a l3 interface of 192.168.0.0/x on openlan router then static pat for those two hosts only.