[Tfug] Network partitioning

[Bexley Hall]

Hi,

I'm looking for quick and dirty way to partition a network
to isolate subnets from each other (to varying degrees).

In essence:
- a group of "internal" machines that need to be able to
   talk together
- a group of "shared resources"*
- another group of machines that don't really need to talk
   to each other (though if they did, the world wouldn't end)

The shared resources are things like internet connection,
printers, file servers, etc.  I.e., everyone probably wants to
be able to access these (*though a printer shouldn't be
accessible from the internet connection so I guess you'd
really want to split into yet another group).

What's the simplest "no maintenance" way of doing this?
Ideally, via a turnkey appliance (instead of a "real system"
added for this role).

Thx,
--don