Critique my design, please?

cmb

I would change the interface naming for LAN, someone might misunderstand that acronym :P

When I see POS I think Piece of Sh_T not Point of Sale ;) So yeah I would change it ;)

Good design advice. :)

I've worked on a couple customer systems before with similarly-named interfaces, POS_NET or something, and just think to myself "man no wonder, this network was doomed from the start with a name like that."

jsaad

I've changed it to POINT_OF_SALE.

The camera system is a single windows computer (analog cameras) and there are only 2 other windows computers.

This is an effort at PCI compliant solution that requires the point of sale equipment on the network to be isolated. obviously other measures need to be taken on the actual PCs and point of sale equipment.

tim.mcmanus

I would have left it as POS, the rest of these nerds be damned! I support POS installations, both kinds.

jsaad

We've set this up. Customer wants to print to a LAN printer on the POS_NETWORK from the STAFF_NETWORK.

However If I open up firewall rules to allow for windows printing 137-139 and 445. won't that defeat the purpose of separate networks? Won't it be wide open, then?

Can the firewall rules allow specific ports to a specific IP address?

phil.davis

Make sure the printer has a known static IP in LAN. Then add a firewall rule on POS to pass source POSnet destination Printer-IP ports 137-139,445
It is easy if you make an alias "LANprinters" for the IP of the LAN printer - then you can add to that when another printer appears. And make a ports alias for the list of ports that need to be open to the printer.

doktornotor

137-139 and 445 is not for printing. It's for the crappy network browsing. Really cannot see how's this needed? Just point the damned printing to an FQDN or IP of the printer.

MikeV7896

Printer ports would be 9100 TCP for HP JetDirect or 515 TCP for LPR/LPD. As mentioned, the other ports mentioned in this topic are for Windows networking (NetBIOS, SMB, etc.).

kejianshi

Is your POS pfsense rig working ok?

jsaad

ok, great advice. thanks! enjoy the weekend!

Derelict

We've set this up. Customer wants to print to a LAN printer on the POS_NETWORK from the STAFF_NETWORK.

I would put the printer on the LAN network and make firewall rules so the POS stations could print to the printer on LAN instead of punching holes in the firewall in the other direction from LAN (unprotected) to POS (protected)..

My LAN rule would be:

reject any source any dest POS Net

I would also make the two networks more random and contained in one subnet, say (staying in 10/8 which is ill-advised to begin with):

10.67.234.0/24
10.67.235.0/24

Then the site can be referenced with a single /23.

jsaad

@kejianshi:

Is your POS pfsense rig working ok?

Runs good. Ordered another!