Netopia 4686-XL - Can it separate internet from VPN?

[djcronos]

Hello,

Our business has 3 different locations. All 3 locations have DSL currently installed. We were planning on purchasing 3 Netopia 4686-XL's and hooking those up to the DSL modem, and then the computer to that router. We want to have 2 computers at each location tied into the VPN that would only be able to access the VPN and not be able to access the internet. If it matters, they will be contacting port 821 only. We also want to have two other computers that aren't connected to the VPN to be able to view web pages, email, etc. and not be able to tinker with the other machines which are in the VPN.

Is this possible using the Netopia 4686-XL, or would I have to look into using alternatives?

Thanks in advance.

[MadBeaver]

I haven't used a Netopia 4686-XL before, but from what I can tell you should be able to do what you by using the filters in the firewall.

[djcronos]

Thanks for the response. I'll look into this a little more. I think we're going to go with these routers. At worst, we'll return them.

Thanks again! If anyone else has any comments, I'd sure like to hear 'em!

[phishphreek]

Do you want to prevent them from internet access ALL together, or just not use your resources?

If you want to allow them to use their own internet connection while connected to the VPN, then setup split tunneling.

Basically, only traffic destined for resources contained within the VPN go through the VPN. This alleviates some bottlenecks associated with internet traffic over the VPN. The user would use their own internet connection. So, the user would still be able to surf the web, listen to streaming media, etc. They just do it with their own bandwidth.

If you want to prevent ALL internet traffic while the VPN is connected, then create ACLs in the router like MadBeaver suggests.

[djcronos]

I didn't include this in the original, and I apologize if this makes any difference (I thought it wouldnt). We have another server which is going to be colocated at a hosting company that will have the same VPN router attached to it. Basically, we have 2 computers at each store which will be contacting that server located at the hosting company. We want to make it as secure as possible by only allowing those computers to talk to each other, and nothing else. We wanted to give our employees a couple laptops they could plug into the router so they could view web pages, go on myspace, etc. but will NEVER be able to access the other computers inside the VPN.

Make sense?

[DjM]

We wanted to give our employees a couple laptops they could plug into the router so they could view web pages, go on myspace, etc.

Myspace......employees....whats wrong with that picture.

Cheers:

[djcronos]

A lot...but your comment doesn't help my issue