Critique my design, please?

cmb · Jul 17, 2015, 6:26 AM

I would change the interface naming for LAN, someone might misunderstand that acronym :P

When I see POS I think Piece of Sh_T not Point of Sale ;) So yeah I would change it ;)

Good design advice. :)

I've worked on a couple customer systems before with similarly-named interfaces, POS_NET or something, and just think to myself "man no wonder, this network was doomed from the start with a name like that."

jsaad · Jul 17, 2015, 5:01 PM

I've changed it to POINT_OF_SALE.

The camera system is a single windows computer (analog cameras) and there are only 2 other windows computers.

This is an effort at PCI compliant solution that requires the point of sale equipment on the network to be isolated. obviously other measures need to be taken on the actual PCs and point of sale equipment.

tim.mcmanus · Jul 17, 2015, 10:12 PM

I would have left it as POS, the rest of these nerds be damned! I support POS installations, both kinds.

jsaad · Jul 31, 2015, 5:33 PM

We've set this up. Customer wants to print to a LAN printer on the POS_NETWORK from the STAFF_NETWORK.

However If I open up firewall rules to allow for windows printing 137-139 and 445. won't that defeat the purpose of separate networks? Won't it be wide open, then?

Can the firewall rules allow specific ports to a specific IP address?

phil.davis · Jul 31, 2015, 5:40 PM

Make sure the printer has a known static IP in LAN. Then add a firewall rule on POS to pass source POSnet destination Printer-IP ports 137-139,445
It is easy if you make an alias "LANprinters" for the IP of the LAN printer - then you can add to that when another printer appears. And make a ports alias for the list of ports that need to be open to the printer.

doktornotor · Jul 31, 2015, 5:43 PM

137-139 and 445 is not for printing. It's for the crappy network browsing. Really cannot see how's this needed? Just point the damned printing to an FQDN or IP of the printer.

MikeV7896 · Jul 31, 2015, 6:19 PM

Printer ports would be 9100 TCP for HP JetDirect or 515 TCP for LPR/LPD. As mentioned, the other ports mentioned in this topic are for Windows networking (NetBIOS, SMB, etc.).

kejianshi · Jul 31, 2015, 8:07 PM

Is your POS pfsense rig working ok?

jsaad · Jul 31, 2015, 8:24 PM

ok, great advice. thanks! enjoy the weekend!

Derelict · Aug 1, 2015, 6:48 AM

We've set this up. Customer wants to print to a LAN printer on the POS_NETWORK from the STAFF_NETWORK.

I would put the printer on the LAN network and make firewall rules so the POS stations could print to the printer on LAN instead of punching holes in the firewall in the other direction from LAN (unprotected) to POS (protected)..

My LAN rule would be:

reject any source any dest POS Net

I would also make the two networks more random and contained in one subnet, say (staying in 10/8 which is ill-advised to begin with):

10.67.234.0/24
10.67.235.0/24

Then the site can be referenced with a single /23.

jsaad · Aug 5, 2015, 1:52 PM

@kejianshi:

Is your POS pfsense rig working ok?

Runs good. Ordered another!