How to share internet connection Securely on Office LAN?

[bhvm]

Dear all,
We have a small Office lan consisting of 6~7 Machines. The Machines are connected to a single modem (TP-LInk WDR 4300) Either via CAT 6 cable or WIFI. The Lan is currently being used to Share Files & Softwares across the machines.


Now, I would like to add in an Internet connection in this modem ( Modem has a WAN Port for that).
My doubts are-

1> How to share Internet connection Safely & Securely without leaking my shared files & Softwares on the Internet?
2> How to Restrict Internet to a select few Machines connected to his modem?

3> How to be overall safe and prevent any Attacks/Viruses/Loopholes as the Office machines have sensitive data.

EDIT-
I tried reading a few Links but could'nt understand it-
How to Share an Internet Connection in Windows 7 - For Dummies

There is no mention about how to prevent office files from leaking on the Internet.

 

[LMiller7]

Internet Connection Sharing is not the best way to go. Most home users and small businesses use a router. This will perform better and have more security and other features.

But if no one in your organization has the knowledge to set this up you would do well to obtain the services of a professional who does. You don't want to get this wrong, and there are plenty of ways that can happen. This cannot be adequately dealt with on a forum.

 

[bhvm]

Thanks for putting things squarely. I Guess TP link WDR 4300 is a router itself, no?
Yes you're right that windows ICS won't do the trick. There is no controls to how or how not to mix Lan traffic with Internet. I need something a little more advanced.

My only simple option remains is to add a second router excursively for INTERNET, keeping the office lan undisturbed. but I will not be able to surf the Internet unless in unplug office lan & Plug in (dedicated) Internet lan cable. Seems cumbersome. any better ideas?

 

[LMiller7]

The only suggestion I will make is one have already done. I have a firm belief that business networks should be set up by a professional. There is an old saying that is very apt here "A little knowledge is a dangerous thing". Even with the very best of help from a forum, that is what you will have. There is a big gap between the knowledge you will obtain from asking questions on a forum and that needed to do this job right.

 

[bhvm]

Thanks for Further Info.
I did the next most logical thing. Added a second WIFI modem for Internet, Keeping Office lan Untouched.
The office lan is set as HOME, connected to machine via Ethernet
The Internet is set as PUBLIC, connected to SAME laptop, via WIFI adapter.

Please check the screenshots for details.
Does this still pose a risk?

 

[GokAy]

Are you any more safer to outside like this?!

Just use access control of your router, and/or use static IPs with no gateway set for Internet-restricted PCs? 1 router should be enough. If not just get a small business firewall if you ask me.