I need to isolate one computer in a small office from the office network - from both NetBIOS networking with other machines and at the IP level. The office is just one of a number of businesses in one building - each office has its own network & internet connection hardware connected to a patchbay in a cupboard - I've already tried some measures to physically isolate the machine in question with some wiring changes, but as soon as the device is plugged into the patchbay, the router that provides the office internet connection appears to connect the whole lot anyway (basic NetGear ADSL router).
We have a Netgear Smartswitch on which I've set up a VLAN to encompass all the machines I do want networked and another VLAN that only includes this one machine and the internet port. I can still ping the other office machines from the `isolated` PC and vice versa even though it can't be accessed via NetBIOS. Is a VLAN strictly a Layer 2 thing, or would a Layer 3 managed switch incorporate VLANs that operate at the IP level too? We have some security requirements to fulfil for a planned project, and until there is money available I can't simply move the isolated PC to its own dedicated internet connection (which is the ideal). I know I could use a firewall and block internal private addresses but if the project takes off, a hardware device that deals with unwanted traffic before it can get to the PC in the first place would be the best option.The PC in question will be used for remote-assistance, accessing other computers over the internet. Any suggestions and insight welcome.