Securing work computer on home LAN

[Major Payne]

Hello all!

My wife is now working from home, her employer is shipping a computer and peripherals next week. I'm always concerned about the integrity of our home network, so much that when guest come to the house I pass out a "guest network" card just in case they have something funky on their phone. I'd like to also isolate my wife's work computer really because I don't know the employer or their employees - if one of their computers is compromised I don't want something propagating to our network. I can't see a way to do this simply though, since their cyber security policy specifies the computer must be always on connected via ethernet, not wifi.

Our home router is a ASUS AC86U.

Any suggestions?

 

[tgl]

My wife is now working from home, her employer is shipping a computer and peripherals next week. I'm always concerned about the integrity of our home network, so much that when guest come to the house I pass out a "guest network" card just in case they have something funky on their phone. I'd like to also isolate my wife's work computer really because I don't know the employer or their employees - if one of their computers is compromised I don't want something propagating to our network. I can't see a way to do this simply though, since their cyber security policy specifies the computer must be always on connected via ethernet, not wifi.

You could isolate it with a VLAN, given a VLAN-aware switch ...

Our home router is a ASUS AC86

... but current ASUS gear doesn't do VLANs, as far as I've heard. Are you prepared to spend money on guaranteeing extra isolation?

 

[drinkingbird]

Hello all!

My wife is now working from home, her employer is shipping a computer and peripherals next week. I'm always concerned about the integrity of our home network, so much that when guest come to the house I pass out a "guest network" card just in case they have something funky on their phone. I'd like to also isolate my wife's work computer really because I don't know the employer or their employees - if one of their computers is compromised I don't want something propagating to our network. I can't see a way to do this simply though, since their cyber security policy specifies the computer must be always on connected via ethernet, not wifi.

Our home router is a ASUS AC86U.

Any suggestions?

Weird that they require you to use wired, my company is pretty strict and allows either (they have a special wifi port guard and we use VPN anyway). I would tell them that your cyber security policy requires it to be connected to wifi

There is a relatively simple script to put one of the wired ports into the guest network which will isolate it from the main LAN, but not sure you want to get into scripting. If not you will need a vlan aware router and switch. Asus is supposedly releasing VLAN aware Pro routers but you may want to look at Ubiquiti (edgerouter X plus an access point) or TP-Link pro stuff. Both are pretty reasonably priced.

Or you could use any cheap router and put her behind that, plugged into your main router. If it has a firewall, block your main LAN subnet in that firewall so it can't communicate with it. Or the opposite, put her only on the first router and everything else on the second router.

I guess another idea is to do it "backwards". As long as you don't have any wired devices, put her on the main LAN and all your other stuff on guest wifi with access intranet disabled. But that would leave her able to access the router GUI (not a huge deal) and none of your other stuff would be able to hit it.

I have a script to put one of my ports into the guest VLAN on the asus and my work PC is plugged into that. Then a custom firewall rule to allow it to print to my printer on the main LAN.

There are some switches out there that can do filtering to block her access to the main LAN subnet, but they are relatively expensive, probably more than a router+AP from one of the ones I mention above.

 

[bbunge]

There are some Ethernet to WIFI devices out there such as this: https://www.amazon.com/dp/B018YPWORE/?tag=snbforums-20

You could also build a media bridge from an old router and connect that to a guest WIFI on the AC86U. I used to travel with an old WRT54G that ran DD-WRT configured as a promiscuous router to access motel WIFI with my non-WIFI laptop. The government cyber police never caught me doing anything wrong.

 

[Major Payne]

I appreciate all the suggestions!

@tgl and @drinkingbird I have an older ASUS router packed away as a spare/backup.

Just for the sake of perspective, my wife's office space connects to the router from a wall ethernet jack, then a Netgear gigabit smart managed switch connected to that jack. I put that switch in to allow her to connect a computer, network printer, and company phone. I'm not super network savvy so I gotta ask, could that switch be a solution to my problem?

@bbunge I might try that as a last resort, good info thanks a lot.

 

[drinkingbird]

I appreciate all the suggestions!

@tgl and @drinkingbird I have an older ASUS router packed away as a spare/backup.

Just for the sake of perspective, my wife's office space connects to the router from a wall ethernet jack, then a Netgear gigabit smart managed switch connected to that jack. I put that switch in to allow her to connect a computer, network printer, and company phone. I'm not super network savvy so I gotta ask, could that switch be a solution to my problem?

@bbunge I might try that as a last resort, good info thanks a lot.

Yes, the switch should work for you.

Here is a basic config.
-Main router must be running 386 firmware.
-Enable guest wireless 1 2.4ghz only. It must be GW1, not 2 or 3. Set the SSID to anything other than your main LAN (WiredGuest or whatever) and select "hide ssid". Use WPA2-AES and set the pre-shared key just to protect it, but you don't need to remember it, just fill it with random letters and numbers. Set access intranet to disabled. Note I don't think the bandwidth limiter will work for the wired guest, but it might. Never tried.
-Reboot router
-On your switch, add VLAN 501
-On the port uplinking to your router, leave vlan 1 untagged, set 501 tagged. Leave the PVID of the port as 1.
-On all other ports on the switch, set them to VLAN 501 untagged, and set the PVID of those ports to 501 also

To be clear, enabling the guest wireless is just to create the VLANs and assign them to the LAN ports on the router (which it does automatically for Aimesh, even if you don't have aimesh enabled), the wireless won't actually be used for her stuff.

This will make her stuff appear to be on the guest wifi, but will show it as hardwired in the client list.

If you want something main LAN in that room, set that port on the switch to vlan 1 untagged and pvid 1 (which is the default for all ports unless you change it). It will be totally isolated even though it is on the same switch. Just make sure she knows not to plug work stuff into that port/ports. All her work stuff on VLAN 501 will be able to see and access each other so she can print, etc, and can access the internet, just not the main LAN or router.

Of course do some testing to make sure it is working and they are isolated. This definitely works on non-HND routers like the 68U, but your HND 86U is a bit different. However as far as I know it should work the same. Plug a laptop into the switch (one of the VLAN 501 ports if you didn't set them all to 501), it should get a 192.168.101.x IP. It should not be able to ping the router (192.168.101.1) or access the GUI. It should not be able to ping or otherwise access anything on your main LAN, including the main router IP (probably 192.168.1.1 or 192.168.50.1). But internet access should work as normal.

If you have/want a true guest wireless also (or if you're already using GW1), that can be done easily, I just didn't include it here for simplicity. There are a couple options, let me know if you want that.

You can also have two VLANs feeding that switch if you wanted to be able to have two different isolated segments, but doesn't sound like you have a need for that. If so I can tell you how to do that too, basically all the same as above but also enable 5ghz on GW1 and the VLAN will be 502, which you can tag on the uplink port along with 501, and set some switch ports into 502 untagged/pvid 502 for that second segment. So in that setup you could have your switch with LAN ports (VLAN 1) and two different wired guest segments (501 and 502).

 

[drinkingbird]

You could isolate it with a VLAN, given a VLAN-aware switch ...



... but current ASUS gear doesn't do VLANs, as far as I've heard. Are you prepared to spend money on guaranteeing extra isolation?

Actually on 386 code base it uses VLANs, you just can't customize them. But you can take advantage of them with a VLAN aware switch.

 

[Major Payne]

Enable guest wireless 1 2.4ghz only. It must be GW1, not 2 or 3.

Not clear on this - do you mean setting the index number for that radio?

On your switch, add VLAN 501
-On the port uplinking to your router, leave vlan 1 untagged, set 501 tagged. Leave the PVID of the port as 1.
-On all other ports on the switch, set them to VLAN 501 untagged, and set the PVID of those ports to 501 also

I don't see any of this, specifically "VLAN 501" on my GSS108E switch, unless I'm looking in the wrong place. Or I'm likely not understanding your instructions. This is what the VLAN page looks like.

 

[drinkingbird]

Not clear on this - do you mean setting the index number for that radio?



I don't see any of this, specifically "VLAN 501" on my GSS108E switch, unless I'm looking in the wrong place. Or I'm likely not understanding your instructions. This is what the VLAN page looks like.
View attachment 49936

No I mean under "guest network" in your router, enable the left most one on 2.4 ghz (top).

In the switch you must add VLAN 501 yourself, then you can set ports into it, choose whether tagged or untagged, and use it as a PVID for ports also. Somewhere in there you should be able to type in "501" and click "add". It should be under 802.1Q VLAN configuration not port based vlans, once you start using 802.1Q the port based will no longer work, that is for something else.

Here is a netgear page on it https://kb.netgear.com/30919/How-to...lus-Switch-with-shared-access-to-the-internet

 

[ddaenen1]

Hello all!

I'd like to also isolate my wife's work computer really because I don't know the employer or their employees - if one of their computers is compromised I don't want something propagating to our network. I can't see a way to do this simply though, since their cyber security policy specifies the computer must be always on connected via ethernet, not wifi.

Any respectable company has very strict IT policies. In that sense, i find it a bit odd that you are concerned about the company your wife works for. I also find it odd that the policy is to be connected via ethernet rather than wifi. I have worked for several large multinationals and have never seen such a requirement. At best the use of a VPN is required but in most cases, that is only necessary to access certain company applications, not for Offfice applications including Sharepoint.

It will either through VLAN, as mentioned already, or alternatively through a separate internet connection, maybe funded by the company?

 

[drinkingbird]

Not clear on this - do you mean setting the index number for that radio?



I don't see any of this, specifically "VLAN 501" on my GSS108E switch, unless I'm looking in the wrong place. Or I'm likely not understanding your instructions. This is what the VLAN page looks like.

Any luck?

 

[tgl]

I don't see any of this, specifically "VLAN 501" on my GSS108E switch, unless I'm looking in the wrong place. Or I'm likely not understanding your instructions. This is what the VLAN page looks like.

Hmm ... what happens if you pull down the "VLAN identifier" menu? If there's no sort of "Add VLAN" button visible at the top level, I'm guessing it must be hidden in a pulldown menu.

 

[drinkingbird]

Hmm ... what happens if you pull down the "VLAN identifier" menu? If there's no sort of "Add VLAN" button visible at the top level, I'm guessing it must be hidden in a pulldown menu.

He's on the port based VLAN screen which is different from the 802.1Q VLAN screen. Once you enable .1Q, port based is disabled. The .1Q screen lets you add vlans.

 

[j3tz]

...

I have a script to put one of my ports into the guest VLAN on the asus and my work PC is plugged into that. Then a custom firewall rule to allow it to print to my printer on the main LAN.

...

@drinkingbird

I have an Asus GT-AX11000 Pro but feel like I need a Ph.D. to configure it. I feel I would do better working with a script than the GUI, but not sure where to begin.

I'm in a similar position as OP. I'm a remote employee and would like to make home network more secure. I remote desktop connect (windows RDC) from home computer to work computer (both are behind home router) to avoid using a KVM switch.

I was thinking of creating VLAN's and putting work computer on one VLAN and home computer on another VLAN and then somehow permitting access to work computer from home computer. I don't need to access either computer from outside home so not needing to get through WAN to LAN. Any ideas?

 

[j3tz]

Any respectable company has very strict IT policies. In that sense, i find it a bit odd that you are concerned about the company your wife works for. I also find it odd that the policy is to be connected via ethernet rather than wifi. I have worked for several large multinationals and have never seen such a requirement. At best the use of a VPN is required but in most cases, that is only necessary to access certain company applications, not for Offfice applications including Sharepoint.

It will either through VLAN, as mentioned already, or alternatively through a separate internet connection, maybe funded by the company?

I can see both sides.

Some companies have very aggressive security applications deployed that will crawl the network beyond company equipment and start getting into personal phones and IoT devices.

Established companies aren't immune to mistakes or hacks etc. Misplaced equipment etc. They just tend to not publicly disclose such problems since it bothers the shareholders.

Consumers and companies have the same desires with respect to security and privacy.