This would really be vendor-specific information. What firewall are you using?

@gravyface: Is it really an odd request? I thought it was common for a parent company to seek to isolate two child operations.

@gravyface: As a networks n00b, I'll have to research some of the terms you mention, but the information does appear helpful.

@Abraxas it's really just NAT, but you'll run into terms like proxy ARP and policy (source) routing, depending on what you're doing and how it's implemented.

@IsaacKleinman isolating networks (webservers in a DMZ, company A from company B, department A, from department B) is Standard Operating Procedure; NAT'ing clients out as different public IPs isn't really something I'd see as being all that useful, unless maybe you're concerned with SMTP blacklisting or something, but if you have control over edge network, you might as well put the same security policies in place to equally protect both.

@gravyface: if my assumption is correct, the client's concern is that a particular third-party they interact with over the web will assume company A and company B are the same concern if they use the same public-facing ip addresses.

@IsaacKleinman see my edit. Getting a different Internet connection is the correct answer here.

@gravyface: but the rest of the steps you describe remain the same?

@IsaacKleinman with a secondary Internet connection, you'd follow a typical multi-WAN setup (but forgoing the failover/load balancing bit), but you'd be looking at policy (source) routing instead where you'd be actually creating routes based on source address(es) to determine which WAN interface the traffic leaves; likely the NAT rules would be auto-created at that point, but this is all vendor-dependent.

@gravyface: So I need to use something like this?

@IsaacKleinman you'd have to check the manual/specs to see, but $55 router to support two businesses? Yikes.

:D Like I said I'm a networking n00b. I do programming, just scrambling here on a networking task.

Do you even need to share routers? If the cabling is up to spec and there's labelled drops and physical separation between offices, you could just get two of those routers and a couple of cheap 8/16/24 port switches and wire up two physically separate networks.

Are they planning on sharing resources (like printers, etc.)?

so it's actually a really small business for now. Just working with a handful of PCs.

I can recommend getting a new set of computers and printers but that seems wasteful to me.

Same folks will be working on both "businesses".

so I figured I'd just set up VMs on their machines for business B.

Does that make sense?

I think you're entering a whole world of hurt just for sake of security theater in one business user's mind's eye.

What do you mean?

If these are all the same people, but acting on behalf of two different companies, all this network malarkey is pretty pointless.

I believe his concern is just that he be able to appear as two different entities to another party he interacts with

I have clients that do the same; we setup different email domains and added secondary accounts in Outlook to appear as though they're different.

public IP that the machines NAT out as is crazy talk. Who's looking at IP addresses?

He claims Amazon does :)

I don't know that that's actually the case

Creating VMs (and you'll need multiple NICs on the machines or have VLAN capable NICs/switches to get the VM on a second network) and all that is a lot of overhead and considering you don't really know what you're doing (no offense), you're taking on a lot of complexity just in case someone happens to see an IP overlap between two companies.

I totally hear you. He's just being careful not to blow his reputation with them.

I guess one of his peers must have told him about ip addresses cuz he knows nothing about such things.

what part of Amazon? Web Services, like EC2?

No. He's a merchant.

so he's pedalling merch via Amazon, but operating as two different companies?

My understanding he sells under multiple names. Apparently Amazon doesn't like that and tries to sniff out folks doing this kind of stuff by checking ip addresses.

exactly.

running VMs will be a PITA.

I can imagine

Thought it might be an opportunity for me to learn how to do these things

Honestly I would just use an anonimizer service and setup like Firefox for company B with FoxyProxy and Chrome/IE whatever for company A; keep it idiot-proof. Would be like 5 bucks a month.

but I can also just tell him to purchase another 2-3 PCs

there are so many nowadays so people can region hop on Netflix, etc.

I see.

You've been a great help!

Do you have a public blog or something like that?

all web traffic would proxy out as the anonymous service and by keeping it to FireFox, he can be logged in as two different accounts/cookies/etc.

Nope.

that definitely sounds like a more reasonable route.

Yup.

alright, need to get some work done. Cheers.

:) Thanks again.