5

I run a small hostel and have the following network configuration:

Router1 (192.168.1.1) ─┬─ (192.168.1.2) Ubuntu Samba+SSH Server
                       ├─ (192.168.1.X) Router 2 (192.168.2.1) ─┬─ (192.168.2.X) GuestPC1
                       ├─ (192.168.1.X) AdminPC1                ├─ (192.168.2.X) GuestPC2
                       ├─ (192.168.1.X) AdminPC2                ├─ (192.168.2.X) GuestPC3
                       :                                        :
                       :                                        :
                       └─ etc.                                  └─ etc.

192.168.1.X is the ADMIN network which we'd like to keep private from the GUEST network (192.168.2.X) save for some shared Samba folders on 192.168.1.2.

All computers on both networks get their IP addresses via DHCP, except for the Samba+SSH Server which uses static IP.

I noticed that the GuestPC's are able to access the Ubuntu Samba+SSH Server, despite configuring ufw to allow only 192.168.1.0/24.

After researching a bit on the Internet, it seems that connections from the GuestPC's are able to masquerade on my ADMIN network because of NAT on Router 2. Thus, given only the above ufw rule, GuestPC's are able to fully access the Samba and SSH services without restriction.

My question is, what is the proper way of preventing the GUEST network (192.168.2.X) computers from accessing the ADMIN network (192.168.1.X)? Is there a better way than setting Router 2 to static IP and blocking its IP using ufw on the Ubuntu server?

2 Answers 2

4

You can reverse network1 and network2, ie have your Office network behind the second router, and have that, and the guests plug into the first router. That is probably the simplest solution (and viable, assuming you don't have an issue with double-nat, which you are doing any way).

As your network stands, you can't block access to the server using rules on your (internet connected) router - as the traffic never goes there. You could possibly block it from your secondary router.

You don't specify where you are using this ufw rule (or what it is), but if you want to prevent guests accessing your SAMBA server you have at least a couple of alternatives [ assuming you don't modify your network as per my first suggestion ]

  1. Get rid of NAT on your second router. In addition to turning off NAT you will need to push a route for 192.168.2.0/24 from your first router to your second router. This will allow you to identify the second network by its IP range and block it on router 2.

    OR

  2. Change the WAN interface on router2 to a static IP address, and block that on the Ubuntu server (and/or router 2).

2
  • Thanks, didn't occur to me to tackle the problem at the topology level. Looks like our #2 solution requires the least effort; as I have all my hardware and wires cleanly laid out already. Will just stick to an all software solution. Mar 12, 2013 at 10:25
  • Reversing the networks will allow your guests to interfer with your Internet traffic, for example by ARP spoofing. Jul 13, 2014 at 17:54
0

If you can spare a PC would suggest using m0nowall, it's a FreeBSD distro specialized for secure networking applications. It has that feature you want providing that you equip the PC with or more NICs

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .