Dual LAN [Suggestions Needed]

[zwunder]

I work at a movie theatre, and we have a single PC that we use for projecting non-cinema content onto our projector. We also use this PC to control every function of the projector, however we also need to have it connected to the internet, so here are where the problems start. 

 

The projector has it's own LAN that it runs between itself, the media server, and our audio DSP. We also plug the PC into this network to control the projector, however this LAN cannot be internet connected for security reasons. We also have a building LAN that has all of our computer systems on it that is internet connected. Basically I need a good suggestion for how to connect the PC to both LAN's simultaneously. I need it to be able to talk to the projector via one LAN and to the internet via the other.

 

I have no networking experience so I am coming here hoping someone can help solve this issue.

[Blebekblebek]

who setup/manage the network?

you can bridge multiple LAN connection but I doubt that would works if IP distribution is based on MAC Address reservation.

[techguru]

you could do this with a 3rd party firmware on the router

hook everything up to the router and then disable certain ports from talking to the outside network

[zwunder]

We were looking at a dual LAN PCIe card, would that work?

[flexin1981]

Hi zwunder, 

 

It is a real bad idea trying to have this machine on both networks, to do this properly this machine should be behind a firewall that connects to the internet facing segment. Then you should allow ports and flows that you need to connect to.

 

If you bridge this you are exposing the secured LAN to the net, this includes adding a dual network card setup to the machine.

 

If you could give me a little more info on the models of router/firewall that you have I can help you to design something that will be secure and give you the function that you need.

[zwunder]

Hi zwunder, 

 

It is a real bad idea trying to have this machine on both networks, to do this properly this machine should be behind a firewall that connects to the internet facing segment. Then you should allow ports and flows that you need to connect to.

 

If you bridge this you are exposing the secured LAN to the net, this includes adding a dual network card setup to the machine.

 

If you could give me a little more info on the models of router/firewall that you have I can help you to design something that will be secure and give you the function that you need.

We are just using windows firewall with a Netgear CG3000DCR modem and router, with a five port switch downstream.

[ChineseChef]

I'm with @flexin1981

 

I work on classified and unclassified networks.  For security reasons, they naturally cannot talk.  The moment you connect 2 different networks to 1 PC, they are now talking and you have a breach.  You can get around this with pretty intensive firewalls, we have one, but it is like $250k and extremely specific to its purpose.  One other thing to consider, connecting your secure media network to your theater internet network may be a breach of contract with the media companies.  Windows firewall will not even be close to good enough to prevent crosstalk if that pc gets compromised. 

 

Are you an administrator for both networks?  I would make sure you are even allowed to connect these networks, because basically, once you connect the media network to the internet, it isn't secure anymore.  And it may have most of its security based on not being connected.  When you have a closed network, you can ignore a lot of security problems.

[dzonidev]

Do not, I repeat, do not try to do something like this.

@ChineseChef explained it pretty well why something like this could be a big mistake.

 

Get another PC/Laptop for internet only.

[zwunder]

We have solved this by literally cutting off internet to the pc and having the PC switch to wifi, which is generated by the secure network only. We are using This to turn off the wiredlan to the PC then windows will automatically switch to the wifi for projector control.

[techguru]

yea except wifi isn't really totally secure

[zwunder]

yea except wifi isn't really totally secure

Over the wifi network you cannot access the media server which is where all of the sensitive media is. The wifi is exclusively for projector control.