How do I partition my on-premises network so one part can only access the external (internet)?

Question

Currently, our setup is the following:

I need to make a change so there is no wireless access to our NAS. The Wifi "passthrough" needs to only be able to communicate with the external internet connection (though through a firewalled router.)

I am relatively inexperienced with networking and would appreciate any help.

Answer 1

What you are trying to do is referred to as zoning - split your network into different security zones (and IP subnets), and use firewall rules to block or permit traffic between the zones.

You need to separate your network zones on the Dell router - either by using different VLANs or configuring the ports as routed/L3 ports, depending on the router's capability set. Separating zones on access switches would also be possible but requires managed switches with VLAN support.

Once you've done that, you can use firewall rules to permit and deny access to other parts of the network. For instance:

• permit workstation subnet access to anywhere
• deny WAP subnet access to private subnets but permit access to elsewhere (Internet).