2

My small business has several network printers and IP cameras, all under the same network. This leads to potential security risks: anyone can print to any printers, and anyone can tamper with the camera system (by installing the Hikvision SADP tools on their computer, get the cam-recorder serial no. then request the local distributor for a password reset).

I'm pretty new to the network administration, and need some suggestions how to solve this problem. I don't need step to step instructions, just general guidelines. I'm pretty sure this problem is trivial and there are more than 1 way to solve it.

Currently, my network equipment are pretty basic: a GPON/router/switch combo provided by ISP (I think it has a lot of advanced features, although I am not really familiar with them, and am still studying) and several dumb switches. I can afford better ones if needed, though.

Improve this question

2 Answers 2

Reset to default
2

The first thing that came to my mind while reading your question was to use firewall rules, until I got to the point where you mentioned several dumb switches.

Since you said that you're new to network administration, I'll explain the mechanics behind some of this stuff and a (hopefully) easy solution for you.

Firewalls have ACL's (access control lists) which basically just control what IP addresses can go where. Your router/switch combo from your ISP has a firewall built into it. There's no way for me to know but I would venture a guess that it is advanced enough to let you create firewall rules. You can use these rules to allow or deny traffic from sources to destinations. If you didn't have any extra switches, then that'd be it and we'd be done... but switches are a different beast.

Network traffic in a dumb switch will not go through the firewall if the traffic is destined for another device connected to the same switch. Switches use something called a MAC address table. A MAC address is a unique hexadecimal number assigned to all networking hardware. A switch records which MAC addresses are communicating through which port. When network traffic comes in, the switch looks at the destined MAC address to see which port it should be sent through. If the destination MAC is connected to a switch port on the same switch then it just gets routed directly to that device thus skipping the firewall/router completely.

Using your existing hardware you may be able to do the following:

  1. Plug the cameras all into the same switch.
  2. Plug that switch into the modem/router/firewall
  3. Make sure that any devices you want to restrict from the cameras are not plugged in to the same switch as the cameras.

This would make all traffic not from that switch route through the firewall and be caught by any firewall rules.

As for your printer security. This is probably best managed by whatever mechanism you're using to share the printer. I would share the printer with only the specific users who need access rather than 'everyone'.

Improve this answer
4
  • Thanks for your suggestions about how to manage the cameras. For the network printers, their default behavior is being shared with everyone, and there is no way to change it from their software/firmware. I am planning to set up a print server which has access to them, then share each printer to desired users. All users should not be able to access the printers directly, and need to print via the server. Whatever mechanism being used, the printers need to be isolated from current network. Should it work with your firewall approach?
    – Livy
    Apr 10, 2019 at 7:25
  • If you put them on a separate switch than the cameras, unless you want the same access for the cameras and the printers.
    – Jeff
    Apr 10, 2019 at 7:52
  • Keep in mind that this solution isn't the most elegant but it should work with what you have. If this helps solve your problem. Please up-vote my answer above and accept it as the solution.
    – Jeff
    Apr 10, 2019 at 7:53
  • I shall upvote once I have enough reputations. Thank you.
    – Livy
    Apr 12, 2019 at 2:42
2

Managed switches with VLANs set up. That's how it's usually done.

That way you can have one Ethernet run from one area to another, but you can have several different devices at the end which can't communicate between themselves. They can be set to only be able to communicate to specific LAN ports on the other side. For instance, the camera can be only allowed to receive data from the Ethernet port that your computer is plugged in to, but the printer which is in the same location can receive data from any Ethernet port on your VLAN enabled switches.

edit: At layer 2, everything going in to the managed switches gets tagged based on how you set up that particular port on the switch. When the Ethernet frame comes out of the VLAN portion of the LAN, and if the port allows that particular tag to leave the port, then its VLAN information can be removed and hosts don't even know that VLANs are in use. You can set whatever tags are allowed to leave, or have all tags allowed.

Improve this answer
2
  • Can a computer have access to both VLANs? My purpose is to access printers and share them to intended users in other VLAN.
    – Livy
    Apr 10, 2019 at 4:35
  • If you computer doesn't support VLANs, then I believe you could give your computer a 3rd tag on its switch port that is allowed to leave on ports belonging to either VLAN, and of course allow its port to receive both or all VLAN tags. Your computer would have two IP addresses for the two LANs sharing the same wire. Better make sure packet forwarding is turned off or your computer could be used to get from one VLAN to the other. I understand the theory, but my experience is limited, so others feel free to comment.
    – Alex Cannon
    Apr 10, 2019 at 16:50

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .