Computer Science Lab

[Theldron]

I am setting up a Computer Science Lab with 19 standalone PCs. The room will have its own server and network, the computers will be unsecures so they will have access to control panel etc. They will have python and scratch installed on the PCs, but I do want the students to have access to the internet. How can i do this without them also having access to other parts of the curriculum network?

 

Many thanks

Sean

[ChrisH]

Do you have VLANs in place? If you haven't just don't set a default gateway. If you have block them at your firewall or use ACLs on your switches.

[Theldron]

No we don't have any VLANs. Don't set a default gateway on the PC or the switch?

[ChrisH]

On the PC.

[MordyT]

That isn't really security though. A smart student will just static on in...

 

You need a firewall or switch and a vlan.

[pete]

^ That. You'll be attracting (based on course content) the very kids who can go "oh, gateway is missing, I'll just add it".

 

Not to mention the other shenanigans they'll get up to in the spirit of "What happens if I.......?"

 

Using a VLAN is the easiest method.

[tmcd35]

Set up a hardware firewall/router to join this separate LAN to your existing LAN only allowing traffic through on Port 80 redirected to your proxy server. An old PC with a couple of NIC's running Linux should do it. I'd also think about using something like Deep Freeze on the PC's so any configuration changes students make in the control panel, etc, are lost on reboot.

[Theldron]

Thanks for the advice guys, but I have got a old 3Com 4200 switch to use for this which doesn't allow for VLANS.

[pcstru]

If you have an old PC with two network ports you could set it up as a firewall. There are several ready rolled linux distributions to choose from.

[Theldron]

Cheers mate, do you know of any good documents on how to set this up?

[pcstru]

It's quite a few years since I used the open source smoothwall, but it was reasonably easy to set up. Physically, you are just putting the firewall between the switch and your network and routing any traffic from the lab straight to your main firewall (and then out to the big bad internet).