Set up a LAN different permissions Build an internal LAN user authority?

Yours is connected to the switch with 4 ADSL routers, and then connected to the PC bar below, so that it is in a local area network, and then it is not in a network segment of the local area network.

Seriously, 4 lines are not easy to do, you need to do all the IP and MAC binding on the router.

For example, there is a router.

Switch No. 5 is connected below.

There are 8 computers connected to switch 5.

Computer 8 is not allowed to access the Internet at this time.

You can bind the IP to the MAC on all 4 routes, remember, it is to set the No. 8 computer on each route, otherwise if he changes to another network segment, he can also connect to the Internet, such as doing MAC binding with the No. 8 computer on the router, and then doing the next ACL, the general route is available.

In the same way, in .10 on all done.

After the above is completed, no matter how he changes his IP, he will not be able to access the Internet.

Why four routers?

Your LAN should be a small LAN café. Just use a four-port router, a broadband line access, connect the router, and then connect the remaining four ports separately to connect four computers, if there are more than four, then use a switch.

Basically, the IP address that enters the router settings is or, and the account may be guest The password is guest. or admin admin

That's it.

Four routers crazy? Why do you need so many routers for just a few computers, if you use a router, it's not a network segment, then it's not a LAN! I feel that you have a big deviation in your understanding ...

In short, if you want to ban the Internet, you can use Easy NetManage, it's very simple! If you want, leave an email in the supplementary question, and I'll pay attention!

The machine that is not allowed to access the Internet is set to automatically obtain all its IP addresses and DNS!

yes, why use four routes? One route is more than enough! If there is a setting permission in the route, you can restrict specific computers from accessing the Internet, so take a good look at the manual.

Just a few machines don't need 4 road travelers, at most one road traveler and one switch

Use a machine as a server and set it up. No, look for me.

Look at the router manual, how to set OK

The world is so crazy! I'm dizzy! You're so rich!

Hide the folder with $filename, and specify the user reject in the folder, specified in security.

For example: pc abc dd$

It's best to share hungry folders not under the same umbrella because of conflicting permissions.

Recommendations such as: PC ABC

PC DD$ -- Designated special person access (security designated server user) <>

Or change the scheme, use FTP, set permissions, different people have different rights, plan three, change NSA, such as Synology, have permission to set, different groups, different user access rights are rotten and confusing, such as bends with FTP

It's relatively simple to set up a LAN with a group:

1.Ensure that all computer IP addresses are on the same network segment as and connected via switches.

2.Set on each computer: Right-click on "My Computer" -- Properties -- > Computer Name -- > Change -- > Enter a name in the text box under "Workgroup". (It's the same on every computer).

It's called a "group".

With "Domain", you need to have a Windows Server 2003 as the server.

1.Install the domain controller in 2003, enter dcpromo in the "Run" dialog box in 2003, and the prompt wizard for installing the domain controller will appear, just follow the prompts.

One thing to note is that when prompted to install a DNS server, you must install the DNS server, otherwise it will be super troublesome to install in the future.

2.On the computers of the rest of the computers, you can set it up: right-click on "My Computer" -- Properties -- > Computer Name -- > Change -> Click on "Domains" below and enter the name of the domain you just created in the text box below. (It's the same on every computer).

Note: When you join a domain, a dialog box will pop up, prompting you to enter your username and password, enter the administrator username and password of 2003, and the username format is: domain name username.

To put it simply, the server adds a domain controller - the server establishes a domain and account group - the server access authorization - the client joins the domain.

1. Server installation windows 2003 server version, and upgrade to active directory (need 2003 server installation disk, you can find the configuration of my server as a domain controller through start--program--management tools--configure my server, after completion, the computer management that appears in the professional version is gone, it has become a standard option in the domain controller, ad users and computers, in which you can create users, groups and so on.) This is what we call a domain-controlled server. ), set DNS** to the LAN IP address of the server.

2. Create an account on the server for each workstation.

AD is Active Directory, where domain users, groups, organizational units, computers, and so on are configured.

Once upgraded to a domain controller, local users and groups are disabled.

Users are configured only in AD.

3. To add each workstation to the domain, you only need to fill in the domain name you used when configuring the domain controller in the system properties - network identity - attributes - subordinate domains, and then change the DNS address to the IP address of the domain controller, so that after you restart the machine, there will be an additional domain option in the login interface that appears, and you can log in to the domain with this option.

4. Set sharing and user permissions on the server.

It's simpler to use the "group" to set up a local area network, without a special server, all the computers are set up in the same group, and the domain must have a special domain server, but also to make a backup, in case one day, the server crashes, the whole network will be paralyzed, it is recommended that if you do not have a lot of computers, use group management, better.

This project involves wiring, so it is generally done by the system integration company, which is more reliable, as for the program, unless your leaders are in charge of IT, otherwise you write it, they can't understand it, they are most concerned about **, so at present, it is better to persuade the leaders to find an outside system integration company to do.

Buy a wire, and you connect it to your brain, and then you have the host on the other end, and you can connect it.

According to the general star topology networking, there is no difference from the general LAN, first ensure that the hardware connection is normal.

1. Set the computer IP address of the guest display group to occupy one network segment, 2. The computer IP address of the sales and finance group occupies another network segment, and set the IP address of the group in the router "IP address filtering" to limit the IP address of the group to the Internet cannot be accessed.

3. The computer IP address of the comprehensive planning and management group occupies the same network segment as the sales and finance group, and there is no restriction on it.

Because the first group and the last two groups are not in the same network segment, they cannot enter the intranet, and the latter two groups are in the same network segment so they can access the intranet, but the second group limits IP filtering in the router, so they cannot access the Internet. If you're afraid that they'll change their IP to surf the Internet, you filter by MAC address.

You can use the Immune Network solution to build your network.

The immune network solution is not a single product, but a complete set of components composed of software and hardware, intranet security protocols, and security policies.

In the patrol immune network solution, various technical means are used to achieve the basic requirements of the immune network. For example:

1. By adding security functions to the access gateway equipment, such as ARP innate immunity, intranet firewall, filter window technology, etc., the requirements of integrated security functions in network equipment are realized;

2. Deploy the terminal immunity driver at the end node of the network by forcibly installing the terminal immunity driver. More importantly, the underlying protocol is also controlled at the NIC level to achieve in-depth defense and control.

3. Through the comprehensive setting, pre-determination and learning of the whole network-wide security policy combination, the active defense is realized, and the known and unknown attack behaviors are inhibited, intervened, and prevented from occurring.

4. Through the operation center running on the server, it handles the alarm information, abnormal traffic, identity verification, etc. from the gateway and terminal driver, audits and evaluates the operation status of the network, and is also responsible for the upgrade and issuance of security policies.

5. The intranet security and management protocol will access the gateway, server, terminal driver and other parts of the network equipment and security functions to form a complete system, and realize the linkage of the whole network equipment.

It can be achieved.

Configure routers to use different IP addresses on the same network segment and use DHCP to allocate different IP pools on the same network segment. Such as:

Connect the two routers through the LAN port with a single network cable.

This can be done to access the Internet normally, but the problem is that the computer connected to router B may obtain the IP assigned by router A and access the Internet through the broadband of router A, and the computer under router A may also obtain the IP assigned by router B and go to router B to access the Internet.

Solution 1: Statically and manually assign IP, turn off the DHCP function of the two routers, and manually set the IP address for the computer, as long as the IP address is in between, the subnet mask, if you want to go to router A, configure the gateway as the address of router A, that is, if you want to go to router B, configure it, DNS can be set to the address of the corresponding router**, you can also specify the DNS assigned by the operator or use Google DNS, such as, it is recommended to use the DNS provided by the operator, You can resolve to CDN nodes closer to you, which speeds up service response. This way is a little troublesome, and it can be used when there are not many computers and do not switch networks frequently.

Solution 2: Buy a router with dual WAN ports, and configure load balancing, and configure the rest the same as ordinary routers, everything becomes easier.