SRW2048 - Restrict LAN Traffic

Question

Hi All,
I have a situation that I'm struggling with.
We're setting up serviced offices for one of our clients. They're requirements are different from anything that we've set up before and I've hit a roadblock here and was wondering if someone could give me some advise.
Setup: 
The setup is for 24 serviced offices where clients rent an office (long-term or temporary) and the company provides internet access, printing, scanning receptionist etc. We have installed an IBM Server running SBS 2008 which provides exchange to the Reception PC's and Company PC's as well as DNS and DHCP to the Clients PC's. So far no problems.
The switch is a Linksys SRW2048 and the Router is a Cisco 857W and they are connected via ADSL.
Here comes the problem: They do not want the Client PC's to see each other, only the Server, Printer and Internet (optional Reception PC)
What I have tried so far: 
1. Setup VLANS on the switch, which failed miserably because the Cisco 857W router does not support additional VLANS. 
2. Setup IP Based ACL's in the Switch which allow traffic to the Server (192.168.0.10), Printer (192.168.0.9), Switch (192.168.0.254) and Router (192.168.0.1) but block access to the 100 addresses in the DHCP Pool. (192.168.0.100 - 192.168.0.200) 
This worked great right up to the point where I enbale the rule and the internet stops working.
If I try to open Google, it works perfectly
If I enable the rule on a client port (bottom row) I cannot see Google (Gets the IP from DNS but cannot ping, telnet etc..)
I disable the rule, Google starts working again
I add Google's IP address to the allow list, renable the rule, works fine.
I'm trying to avoid adding every IP address known to man into the Allow list 
The problem here is beyond my understanding. I havent told it to block everything just a specific range of IP's, but it seems to automatically block every IP except the ones I have allowed.
I also tried allowing Port 80 but it doesn't seem to allow the adding of ports (greyed out) 
3. Tried setting up individual Subnets, but then I cannot see the Printer.
So now I'm well and truly stuck. Could any of you guys either give me another idea or tell me if I'm doing something wrong or advise if I need additional equipment to achieve this.
Many Thanks in advance.
Ryan 
Message Edited by TechsOnsite on 03-10-2009 03:00 AM
Message Edited by TechsOnsite on 03-10-2009 03:01 AM
Message Edited by TechsOnsite on 03-10-2009 03:01 AM

Answer 1

Re 1. If the Cisco does not support (enough) VLANs you have to use a single LAN subnet.
Re 2. For ACLs there is always an implicit "deny all all" rule at the end. Any traffic which does not match any ACL rule will be dropped. Evaluation starts with the first rule and continues until one matches. The matching rule is executed and evaluation stops there. If no rule matches the implicit drop all is effective and drops all your traffic. In other words: you have to add a rule at the end to allow all traffic. The general outline should be something like this:
R1 allow traffic to server, printer, and router. The switch IP address would not be necessary except for the port from which you want to manage the switch.
R2 allow traffic to the broadcast address 255.255.255.255. Otherwise a device on that work won't get an IP address through DHCP.
R3 block traffic to 192.168.0.0/255.255.255.0. This blocks all traffic to your LAN subnet except the traffic which matches R1 before.
R4 allow traffic to 0.0.0.0/0.0.0.0 (or any IP address depending on what you can configure exactly on your switch). This allows all traffic except the one handled by R1,R2,R3.
Re 3. Don't use different subnets in a single LAN. Won't be a secure separation.