Create a separate network for POS systems
Create a separate network for POS systems
She has a modest shop running a POS system and plans to add a separate network later. I considered options, but $1300 for network separation seems high for such a small setup. There should be more budget-friendly solutions that meet the necessary security requirements. I’m looking for affordable alternatives that still work well with current policies.
For straightforward separation you might consider a Firewalla Gold, though it's still quite expensive on its own. Another choice is a basic managed switch that handles VLANs plus a router capable of 802.1q trunking, provided it supports ACLs to restrict the POS system from connecting elsewhere and vice versa would suffice. You could also install a PoE switch for cameras and add a PFSense device or similar as the firewall/router, enforcing the same isolation rules.
Regarding the UniFi Security Gateway, it claims to support VLAN creation and costs around $139. Do you still require a separate router capable of 802.1q trunking or other advanced features? Your note about it being a router suggests you can skip that concern. Edited September 15, 2020 by Modifyinc
We're also looking at a few licenses within the next year for full capabilities. However, a lower-end model should work just fine. What are your specific needs? I think I'll settle for a basic MikroTik or Edge Router, around 100 dollars or less. You likely won't need VLANs—just connect the POS system to one port and the rest to another. How much bandwidth will you require? Probably the edge router unless you already have Unifi devices.
They advised keeping the POS distinct from her primary network. It seems she didn’t require two modems—just ensure the POS isn’t reachable via the other network. Her internet speed is about 75mbs, so maintaining speeds close to what she pays for would be ideal. She doesn’t currently use any Unifi devices. Which edge router were you talking about? EdgeRouter X costs $59, but I doubt it fully isolates the network.
Consider a more basic approach: on the router or AP simply create another wireless network for guests or a second network, enable isolation between APs, and configure separate networks for POS devices with isolation, while assigning different channels for PCs. JP
I’d be cautious about connecting a POS terminal to a wireless network, even with security features. Using the proper tools and patience could allow someone to compromise wireless protection and capture data packets. Adding wireless interference to critical gear isn’t worth the risk, especially when reliability is essential.