So in general I am a home user who is Tech Savy and played a lot with home networking equipment and want to completely secure my network and make it tight and harder to hack than standard home network even though when user done something stupid or got tricked for example to install malware or a reverse shell which for example could have been executed from a PDF file or Microsoft Office Suite like Word etc.
I have recently saw this type of a corporate network and think it is very secure:
(VLAN's with Private IP -> 10.0.X.X) ---> (Proxy/Different Servers) --> <--- (Internet)
It will be hard to explain as the network is kind of complex but here it goes:
The computers in such network have shared network resources which are File Shares as well as printers available to use and each computer have a private local IP address but can't touch each other and it's not possible or more like hard to even infect it. However, when the website is pinged, it only receives a DNS address back through hopping a different internal addresses (10.0.X.X) which I presume are the different machines in the local network setup with DNS Server and NAT to access outside world (?) but packets itself don't reach internet directly from a computer which tried to pinged a website.
Now, when such computer with a local IP address and no internet access at all wants to access outside world, it goes through Proxy/Server which caches content for all the local computers and passes it back to them. Now when the Reverse Shell or in fact any type of virus/malware which needs to call home is executed it cannot spread across the network or even connect back to the C&C server (Command and Control Server) as there is no internet on such computers except the Proxy/Server which caches web content and pushes it back to a local network.
Is it possible to setup similar type of network in home environment or should I just let it go as it might be a bit complex ? I mean, I'm always happy to learn something new.
Also I heard about ClearOS and asked them the same question but it seems that this type of network is not possible to set it up in this software.