Prevent internal LAN intruders

I have a moderate size negihborhood LAN with one public IP address and
a masqueraded private 10.x.x.x network with unmanaged switches (and
maybe some wireless access in the future). There is a strong need to
secure somehow the internal access to the LAN to prevent: IP/MAC
stealing, unauthorized internet access, minimize the risk of internal
IP/MAC spoofing, sniffing & attacks, unauthorized access of computers
to the LAN or users accessing the LAN from some small NAT-ed networks
through connected computers. The gateway machine is a Debian 3.1 box
with kernel 2.4 or 2.6, the LAN workstations range from Win 98 to XP
and maybe some Linuxes.

I did some research and I came up with these conclusions:
- 802.1x not an option - requires expensive 802.1x capable switches
- VLAN not an option - requires expensive VLAN capable switches
- managed switches not an option - expensive
- proxy server - poor solution
- DHCP - poor solution
- static ARP tables - would bring some protection, but MAC addresses
still can be faked

The mininum I need is to make sure that only authorized users can gain
any access to the router and out to the internet. All my research lead
to one solution: IPSec, as it provides certificate-based authentication
on the network, access control and data encryption too.
My question would be: is IPSec the right solution to my issues and, if
yes, how can I implement it. Of course any other solutions are very
welcomed.

Regards,
Szabi

.

Relevant Pages

  • Re: Network Restructuring (Network Design and Equipment)
    ... I decided to put the real network cum equipment diagram of my current ... What is the speed and duplex of HQ LAN ... If you are using hubs and not switches get rid of them and replace ...
    (comp.security.firewalls)
  • Re: Loss of Connectivity on Only One PC on a LAN
    ... When you ran the Network Setup Wizard, ... The original setup of the LAN was done entirely by the user of the other PC on that LAN in July. ... I use a LAN connection which consists of two PCs each connected to a Linksys BEFSR 41 Router. ...
    (microsoft.public.windowsxp.network_web)
  • Re: TCPIP - Ping tool
    ... Strangely enough the answer was under your nose all along, namely PING. ... If your "internal network" corresponds to a Local Area Network (LAN), ... assume the subnet address for your LAN is 192.168.10.0 and the subnet mask ...
    (bit.listserv.ibm-main)
  • Re: Firewall and DMZ topology
    ... attacker cannot spread his influence across the network. ... If the DMZ resides between the public Internet and the ... Should the DMZ be behind the LAN and not split off at the firewall, ... > The Gartner Group just put Neoteris in the top of its Magic Quadrant, ...
    (Security-Basics)
  • Re: Installing multiple SBS VPN clients
    ... please check the Local area network routing only. ... reachable from the remote access server. ... Check to ensure the SBS Server is using a static IP address on its LAN ... Microsoft CSS Online Newsgroup Support ...
    (microsoft.public.windows.server.sbs)