Would a subnet protect the rest of the network when testing for viruses, etc?

Question

Currently I have a standard SOHO router that we connect to browse the Internet, etc. As I doing my internship in networking I would like to know whether a subnet would protect the rest of the network when I am testing other computers.

For example I would like to set up a scenario where I browse the Internet with no antivirus, anti-malware, etc. If one of the test computers I set up is infected I would like to make sure that none of the other computers that are used regularly will be infected.

Does a subnet provide such security? If not what type of setup should I consider and how should I set it up?

Answer 1

It depends on if the subnets are set up to talk to each other. If they are, then it makes no difference and makes more work for you. If they are actually isolated and can only see the Internet, then you should be safe. Try to ping a computer on a separate subnet, and see if you can access it. If you can't, and firewalls are off, then it's likely a safe bet.

Here at my computer shop, we have our Modem plugged into a switch, then two routers off of the switch. One for the 'tech' side, and one for the 'infected' side (aka Customer machines)

Answer 2

Creating a separate subnet doesn't really offer any additional security unless there is some kind of firewall between the two subnets that is filtering traffic.

If malware is going to scan the other network for systems to exploit, they would probably start on the subnet that is in-used on the local machine, but it doesn't stop their, it could simply start scanning other networks.

Answer 3

The only effect different subnets have on virus propagation is if that particular piece of malware only scans the local subnet as an expansion vector. Subnets just mean it has to pass through a layer three device to reach the other subnet. If you were using an old pix or ASA between the two subnets then one would be able to initiate contact in to the other but not vice versa. This is the benefit of using a real SOHO firewall over a soho router with DMZ hosting. The soho router does no isolation on the DMZ host. In this way it is effectively not a DMZ or separate network.

The solution for what you are trying to do if you want not to get infected by infected PCs is to use a real soho firewall that has a real DMZ set up. A pix 501 is pretty cheap on flea-bay. Alternately, you could get an old computer with three network cards and install a linux distro on it...then configure ipchains/iptables appropriately.