Creating a secure LAN within an insecure LAN

Question

I have multiple computers on an insecure network (with third party, untrusted computers). My computers and the third party computers are all behind the same firewall.

Currently my computer's software firewalls are configured to block all traffic from other computers on the network. Unfortunately this does not enable my computers to talk with each other. I would like to modify the setup in such a way that my computers can communicate securely, but no third party systems can impersonate one of my computers or eavesdrop on the communication between my computers.

The problem:

1. I cannot modify the firewall that all of the computers are behind
2. I cannot use static IPs

Can this be done using a VPN or maybe a second hardware firewall? If not, is there some other solution?

I have full administrator access to all of my computers and can add any needed hardware. All of my computers are currently using Windows 7.

Answer 1

VPN sounds as the right solution to your issue, make sure to select one that does not depend on static IPs (the technology should depend on static IPs, but rather on installed certificates, but since static IPs are simpler to configure, it can't be assumed that a given VPN does not depend on them).

A second F/W or other routing based solutions would be a difficult proposition because of the static IP issue.

Answer 2

I am interpreting your question in my answer here (rather than edit its statements).
This way if I am mis-interpreting, you can help fix with comments (and I'll update my answer).

1. You have admin rights to a group of computers (refer them as group 'X')
2. these are behind an Internet facing firewall
3. However, there are other computers here that you refer as 3rd party (call them group 'Y')
4. You do not have useful access on group Y machines
5. You want to secure group X machine communications

You requirement appears like typical service environments taking contract work from different sources with the need to partition all activities across the sources. So, each contract related set of machines would see all other machines as 3rd party. However, you have trouble doing this partition physically -- probably, because the dynamic nature of the contract work; it would imply frequent change in the setup.

You might also be in a leased environment with other people sharing a common perimeter security.

Another analogy is a defence-network.

---

You could look for MACsec based solutions that will secure your network communications.
These will be deployed only on your (group X) machines -- the rest of your internal network will be transparent to this. However, you will need some way to communicate with devices outside your group X. This could be some gateway device or a way to communicate w/o MACsec from these machines.

Answer 3

One possible solution built into Windows is IPsec, which supports authentication with X.509 certificates, pre-shared keys, or Kerberos.