Re: Is it possible to control access between clients on same LAN with a firewall?

On Mon, 25 Jan 2010, William Fitzgerald wrote:

> Dear all,
> 
> I was just wondering how people control access amongst machines on the 
> same subnet (LAN) that are protected by the same firewall.
> 
> In my case, the firewall is a home router (WRT54G) running DD-WRT, so 
> iptables is the firewall there.

I'm going to give you the non-firewall, imperfect but quick and easy 
solution because with my quick reading of the postings I've approved, I 
didn't see anyone suggest it yet- and it works no matter what you're using 
as a router, assuming that it operations normally, and someone hasn't been 
too clever in making it work...

Supernet the router, so use something like say 10.10.0.0/255.255.0.0 as 
the "internal" network on the router.  From here, you'll either need 
relatively smart devices where you can assign routes,  virtual addresses on 
the internal router interface if you've got more than one "dumb" device.  
Let's say we're going to assign the router 10.10.3.1.

Now, let's assume 2 computers, a printer and a WII...

Give the desktop 10.10.1.0/255.255.255.0 as its subnet and assign it an 
address, say 10.10.1.111.  Add a static route to the netbook if you need 
to share files/printers just putting its address in your routing table as 
an interface route.  Now add a static interface route to the router's 
10.10.3.1 address (something like 'route add host 10.10.3.1 netmask 
255.255.255.255 gw en0')  

Give the printer 10.10.1.0/255.255.255.0 as well, as you'll be printing to 
it from the desktop.  It doesn't need to reach the Internet, so it doesn't 
get to route there.

Give your Netbook 10.10.2.0/255.255.255.0 as its subnet and assign it an 
address, say 10.10.2.20.  Print through a queue on the desktop if 
necessary. 

Give your Wii 10.10.3.0/255.255.255.0 as it's network and give it an 
address in that range.  The Wii probably can't add host routes, so it 
needs to be on the same subnet as the router.
  
That's it.  It won't stop an attacker who can add routes, but it'll stop 
anything automatic, anyone who's dumb and 90% of the network 
administrators on the planet from getting from any single device to any 
other that's not a "normal" communication.

Paul
-----------------------------------------------------------------------------
Paul D. Robertson      "My statements in this message are personal opinions
[email protected]       which may have no basis whatsoever in fact."
           Moderator: Firewall-Wizards mailing list
           Art: http://PaulDRobertson.imagekind.com/