Isolating PC on home network

[jwilkinson01]

Hi everyone, I need help trying to figure things out here. I work from home on a company provided laptop that is currently connected to my comcast gateway (TG1682), like all of my personal devices, for internet access so I can connect to my company's VPN. I was given an old mini mac that I decided to use as a NAS to connect a couple of hard drives I had lying around so my wife and I could share pictures, music, etc between her Macbook and my personal Dell laptop. The problem is that the shared drives also show up in the file explorer on my work laptop.

I want to be able to completely isolate the work laptop so it can't see my personal devices and my personal devices cannot see it. I know my work scanned my work laptop once when I had an external drive connected for a backup that I also used to backup my personal laptop and they flipped out because I had personal files attached. I would assume they would also be able to see the personal files on the shared drive.

I am definitely out of my element here so I apologize if anything I say or ask is stupid, I really couldn't find what I wanted by searching online, which almost never happens. Because of the layout of my house the gateway is on the main floor with my wife's Mac wired into one of the ethernet ports on the back of the gateway. Another port off of the gateway goes to a switch in the basement where my office is located and my work laptop, personal laptop and NAS are wired to that.

If I need to purchase a small router for the work laptop I need to be able to have it in the office as well. If I can keep all personal devices connected to the Gateway, either by cable or wireless, the way they are now that would be great. The separate network for work PC does not need wireless capability. I am not sure if I could connect a new router to a port on the switch to accomplish anything. Please advise on the easiest solution!

Thanks!

 

[bill001g]

It really shouldn't matter if the shares exist on the same network. Your work machine should not actially go out and look for them or open things. If the machines is properly configured they can easily prevent you from doing it or at least make you intentionally have to confirm you want to connect to stuff.

The simplest method in a way is to buy a simple router that has firewall abilities. You would configure it with say a wan ip of 192.168.1.x (your current network) and a lan ip of 192.168.2.x. You can still access the 192.168.1.x network though. So you could put a rules in that says you have no access to 192.168.1.x. You could also use any router even without firewall and put the block in for 192.168.1.x in your work machine firewall.

You could I suppose just do what you IT guys in effect would do and put in a firewall rule in the pc that says you can only talk to the router IP of that subnet and not other machines. Nothing to buy but firewall rules can get messy if you move the machine around from network to network a lot.

The ip addresses will of course depend on what subnets you are really using in your house.

 

[Scottray]

Similar to bill001g's recommendation, you could have your IT people configure your work PC to block your home network while you're connected on your company's VPN. It sort of the same as if you where traveling and connected to a public wifi. You have immediate access to sign in to the public wifi and launch the VPN. However there's no access to anything else on the public network.

 

[Karadjgne]

Change the workgroup. This'll put the laptop as a separate network to the home network, allowing internet access but not the home network access.

 

[Alabalcho]

Enable Guest Wi-Fi network on your router, and connect your work laptop to it.

Many company laptops are part of domain/AD, where workgroup concept is missing.