Switch/Router/ Groups/Users question

[zodiac0001]

I have been repairing computers for years. I am still a beginner in networks. I can run wires, add ends, trace wires, add routers switches, set up patch panels etc. but that is about it.

I have been working for this company that has 30 employees and had a disaster in the network closet. 2 10-port switches a 24-port switch and a 14-port switch daisy-chained to each other then to the router (all 10-100) then a 2nd then a 3rd router for some reason. 30 cables running from patch panes to switches. 10 cables from a second patch panel with VOIP. 20 cables right out of the ceiling at one point or another. and 20 more wires running from a hole in the wall across the room on twist ties going nowhere but were good lines.... they had 2 service providers because apparetly the network would bog down and stop for 1/2 hour at a time. and they would unplug the computers and just use a second provider via wireless.

I started with mapping everything and checking each and every plug in the building and now have 2 patch panels and a 1 24-port 10-100-1000 router and a 10-port. right to 1 router All working smoothly now..

Planned steps:
1)
I was going to purchase a managed switch that can equalize the load across both providers. (the company wants this. Apparently the Internet service goes down on a regular basis in the area.. and they do not want to shut down once a month because one or the other is down.)

2)
What my next step is and why I am here is to find out. What is the best way for me to set 2 groups of users. where 1 has a limit of 3 websites and the other has full access to the internet..

Do I get a server and set up users on the server?
Set up each computer with something like Nortons 360?
Get a router with VPN (If i do this how does the 2 providers fit in)


In any of these questions can someone provide specific models..

Thank you 100 times to anyone who helps out.

 

[DainBrammage]

Dude no offense but it sounds like you are in over your head. Managed switches are a good start but typically switches do not make for a good load balancing option. Load balancers run in the 10-20K range for a cheap one as far as separating the users use vlans for that and a cheap way to secure access to the website is via managed DNS solution else you going to be trying to install decent router and firewall. Also the cheap DNS method is easily overridden by anyone who knows what they are doing.

 

[Martin Wilson]

To be honest, I'd recommend you go into discussion with the ISP. They could probably provide a solution which would enable failover to a backup circuit should the primary fail. I would imagine they would use 'tracking' or get funky with BGP to accomplish this.

If you wanted to do this yourself, you would have to invest in a layer 3 switch. You could set up tracking from the switch to monitor connectivity over the Primary path - if it failed, the traffic could route over the backup path. You would have to be pretty clued up with networking to do this yourself though.

With regards limiting some users to '3 websites'. Rather than limiting to the amount of websites, you could look into applying QoS (Quality of Service). Again, this could be done on the Layer 3 switch and can be applied to single users or groups of users on vlans.

I hope this helps - all off the top of my head ... in any case, it's going to cost money

 

[Cerb]

1) A firewall/router/gateway supporting multiple WANs.

2) Whitelisting. There're several ways to do it, but basically, make it where those physical ports, or that wifi network, simply is not allowed to have traffic going anywhere not in the white list. A firewall inside the LAN, double-NATing, would be the cheap and dirty way to do it. But, if you're going with managed switches anyway, you can probably work it into the configuration of an edge firewall.

I'd be in over my head in that scenario, too, but a firewall that supported VLANs (hard to find, right?) and multiple WANs (that really can narrow it down) would be the first thing I'd look into. Well, actually, since everyone I know who does any work like that has been converted to pfSense, I would skip straight to the step of figuring out how to best set up an efficient lab environment, and get some cheap dual-NIC SFF PCs .