Home network re-configuration

[Ozone77]

I have a structured home network that looks like this:

World
+Cable Modem/Router
 + Wireless-N router, DHCP 1 through 50.
  - Work laptop (wireless), VPN once in a while
  - Future devices or visitors (wireless, upon request)
  + Allied Telesyn 24-port dummy/un-managed Switch (Wired, Layer 2?). 
    This switch provides the network to all the rooms in the house (2 drops per room, most ports are un-used):
   - Mac Mini
   - Gaming PC (turned off most of the time nowadays)
   + Wireless-B/G router. Wireless service only. DHCP 51 through 100. Wireless service to:
    - Netbook
    - Tablet
    - Old Laptop (linux)
    - Wii
    - Future devices or visitors (wireless, upon request)

Question #1: I can get a Cisco 2955 (managed, Layer 3?). Should I cut my teeth with IOS to make it the primary/only DHCP device?
Q2: Can the Cisco 2955 provide the firewall/protection required for a home network? Should I also make it the first device after the Router? or should I just keep my current D-link wireless N?
Q3: It would be nice to have 1) NAS or a server to back-up all devices. 2) Shared printing (currently connected to the PC, when my wife wants to print, she just plugs the printer on her netbook).
Should I just get a new/old PC and cut my teeth with pfSense (or something else) to make a router/server that can do all of the above instead?

Comments/suggestions? I don't want/need an email server, but it might be nice to access my pictures/videos from the internet...

 

[berky]

do you have a need to learn IOS? or is it free? if not, I'd personally go with either an actual soho firewall or something of that sort. something that doesn't use much electricity... maybe a mini-pc with pfsense or a small fw appliance.

the 2955 isn't really going to provide much protection as it is not a firewall and not designed to stop attacks.

i personally use a juniper SRX for my home router/firewall. then i use my wireless router as an access point by disabling the DHCP service and plugging it into my router on the LAN side. i also have a managed switch (cisco something) that I have VLAN'ed off for my servers and wireless.

does your wireless N router have 2 antennas? if so, i'd use the b/g one for guests and separate them completely from anything you use for yourself. last thing you want is someone with a virus/malware connecting to your network and infecting your computers. set up a firewall policy only allowing guests to talk out to the internet and not to your stuff.

these are just some ideas.

 

[stiltner]

Your network is only as secure as you make it.

Just having the equipment alone doesn't make it better, especially if you are unsure of proper setup, or skip on things you're unsure of during setup.

Standard "prosumer" routers will work just fine IMO, provide all the options you need and want, and provide you a headache-less setup that will allow you to maintain quality, reliability and most import of all security.

Its not just the door in that you have to worry about, if your machines are lackluster on their configuration, the key out of the door is just as vulnerable an issue. Keep that in mind

 

[Ozone77]

Thanks,

The 2955 is available as a freebie, and we may start using more IOS at work in the future (even that is not clear yet). So I figured I could learn IOS now. I don't think I will pursue this route.

I like Berky's Idea of separating the networks, specially since I noticed that most of those devices are N-capable. I think my N-router configuration was not right, because many devices could not even see it.

As far as a mini-router/PC I have to look into it. I have to see the services that I want (share printer, NAS/backup, media server/recorder, etc...) and then determine the hardware/software for it...