I am trying to understand how a managed switch would help without a router that can have more than a single LAN interface (whether that it dedicated ports or vlans). Does the existing ISP router allow you to add a secondary IP address?
If you have a single switch that will allow all nodes to connnect to it, and the switch allows for client isolation by limiting what other switch ports a specific port is allowed to forward to (SwOS supports this and ROS does at least on some models). That will allow what you want to do while everything is in the same subnet, but it does not scale off a single switch.
Well, the ISP provided router/modem is a "black" (actually navy blue ) box, I have no access to it.
Of course there is a single switch, it is a tiny office network, 9 devices in total, with a central "hub" with the ISP modem and the switch and one ethernet cable going to each of the devices, BUT with an exception, which is that one of the two printers shares the same cable with one of the PC's via a small (unmanaged) 5 port switch.
The problem (or non problem) is that the printers are "common" and should be accessible by both PC#1 and by PC#2-6.
Putting PC#1 on a completely different network and routing it to the /28 network would probably make the whole set of devices "visible" to PC#1, and we would be back to the need to use anyway a /29 one just for the (routed) PC#1 and the two printers.
Your solution is a smart move, but it probably doesn't scale well: what would happen if you decided to add a third group of devices to the party?
And of course, it doesn't provide real security, as it doesn't filter things on the second level.
Mikrotik with VLAN bridge could solve all these issues: each group could go to the separate VLAN and only access VLAN interface which could route traffic between VLANs and you also get ability to filter ports (e.g. you do not want people to access a printer web-interface which is admin-only, do you?), but you probably know it already, so sorry for being captain obvious:)
Another solution is to manage firewall on user devices. If all PCs are Windows, consider running Active Directory, and use group policy to configure firewalls on machines. It is a nice thing to do anyway because if you want people to share files from machine to another, you'd face authentication problems in any case.
Treat the topic more as a Proof Of Concept , not as a daily solution.
Think that we all could agree that it is a setup of "never-touch-it-again" type as it's all academic.
Well, it may be academic, but it is also the situation at a friends office, so, while there is no plan to expand or change anything (in that case I could think about using a managed switch or a router or both) it should (if it does) work daily.
I know. Maybe I worded wrong.
It works as designed but we should be aware of limitations and be aware that any clever enough "someone" could bypass restrictions. If you do not touch anything it works as designed even in a larger scale. Any solution is "proper" if it works as expected/designed.
"Non daily" means just "not suggested as a standard attitude to protection".
Are you saying that PC #1 is not able to ping PC #2? That PC #2 can not ping PC #1?
My guess is that PC #1 is able to ping PC #2.
And if PC #2 is not able to ping PC #1, it is because of the Windows firewall in PC #1.
In other words, if you disable the windows firewall on PC #1 and PC #2, does the solution still work?
What I expect to happen:
Case PC1 192.168.0.11/29 pinging PC2 192.168.0.2/28
PC1 wants to send icmp to 192.168.0.2, it sees that it is not in the 192.168.0.8/29 network, so it sends to its default gateway: 192.168.0.9.
ISP router (192.168.0.9/24) receives icmp for 192.168.0.2 Most routers will then resend the packet back out the same interface it came in on, but will also send an icmp redirect to the original sender; it wasn't expecting to see a request for its network, so it sends an icmp redirect back to PC1 telling it that there is a direct path to this device. (what is the purpose of an icmp redirect)
Assuming that the Router did route the packet, PC2 will now receive the icmp echo request (ping) from 192.168.0.11. As long as its windows firewall allows it, it will respond to this echo request.
PC2 sees that 192.168.0.11/28 (it is using its own mask, not the mask on PC1) is on the same network. It looks in its arp cache for 192.168.0.11 to see if it knows the mac address associated with 192.168.0.11. Let's assume this it the first time, and it does not yet know the mac address associated with 192.168.0.11. So PC2 sends a ARP "who has 192.168.0.11. Tell 192.168.0.9". Because ARP uses ethernet broadcasts, and 192.168.0.11 is in the same broadcase domain, PC1 will receive the ARP message and will respond back. Now PC2 can send the icmp echo response directly back to PC1 (and the trip back will not involve the router at all). Whether this traffic should be blocked or not was never explicitly stated, although "The idea is that PC#1 can only "talk" with internet and the two printers only" suggests that this should be blocked.
What about the reverse direction? I.e. PC2 pinging PC1?
PC2 considers PC1 to be on same network, so it will send directly to PC1 mac address. Router will not be involved. What PC1 does with the request will depend on the windows firewall. Assuming firewall is off, it will resond, but will send back through the router instead of directly.
After writing the above, I asked ChatGPT for its take. If you are interested, this link has its response.
The scope (declared) is that a "casual" user of PC#1 won't find in "Network" any other PC, only the two printers.
The limitations (only implied) Is that the network devices are what they are.
The question Is whether the proposed setup (that works in a simulation/lab) has strange side effects or It Is "wrong".
I understand that:
It Is not "secure"
It Is not "proper" isolation
using VLANs and replacing the existing unmanaged switch and/or adding interLAN routers would give safer and more "proper" results
The impressive explanation by you and by Chat GPT can be easily verified by using tracert from PC#1 to PC#2 and from PC#2 to PC#1, one goes through the gateway, the other doesn't.
Adding more restrictive rules in the Windows firewall (as long as the changes are only on PC#1) Is a good idea and I'll have a look at what can be done with them.
Just skimmed the thread .. .so I'm not sure if anybody mentioned this already ... but the whole scheme (by limiting certain devices from connecting others) will only work if their (common) router will not route between devices within its LAN segment. Neither should it send out ICMP redirect messages (which likely wouldn't work due to subnet mask on other devices being longer).
IMO it would still be much clearer if you used different (non-overlapping) IP subnets ... and only add all relevant IP addresses to router's LAN Interface. Multiple L3 subnets can co-exist on single L2 broadcast domain ... with caveat that they are not properly separated, but you seem to accept this reality already with your setup. But in this case, router will not be "tempted" to mess with ICMP redirect messages.
I know, but the main router is not a Mikrotik (or however I have no access to its settings), it sucks, but it is what it is.
Adding a small Mikrotik to the mix (let's say a hAP lite or even a mAP) between the PC#1 and the switch, I could have the PC#1 on a different subnet, let's say, for the sake of the reasoning 198.18.0.0 with a /30.
So:
PC#1 198.18.0.1/30 <- (this could be also set as DHCP client, making the hAP a DHCP server)
hAP (LAN) 198.18.0.2/30 <- gateway
then
hAP (WAN) 192.168.0.11/29
Route to 0.0.0.0/0 via gateway 192.168.0.9
Route to printer #1 192.168.0.13 and printer #2 192.168.0.14 will be part of the auto-generated (by connection) 192.168.0.8/29
And then I can make a blackhole route for 192.168.0.0/29, thus stopping any communication with PC#2-6.
And optionally also another two blackholes for 192.168.0.10 and 192.168.0.12.
Still it has to be seen how (if) the printers will work while not being on the actual LAN the PC#1 sees.
) box, I have no access to it.