I run a small hostel and have the following network configuration:
Router1 (192.168.1.1) ─┬─ (192.168.1.2) Ubuntu Samba+SSH Server
├─ (192.168.1.X) Router 2 (192.168.2.1) ─┬─ (192.168.2.X) GuestPC1
├─ (192.168.1.X) AdminPC1 ├─ (192.168.2.X) GuestPC2
├─ (192.168.1.X) AdminPC2 ├─ (192.168.2.X) GuestPC3
: :
: :
└─ etc. └─ etc.
192.168.1.X is the ADMIN network which we'd like to keep private from the GUEST network (192.168.2.X) save for some shared Samba folders on 192.168.1.2.
All computers on both networks get their IP addresses via DHCP, except for the Samba+SSH Server which uses static IP.
I noticed that the GuestPC's are able to access the Ubuntu Samba+SSH Server, despite configuring ufw to allow only 192.168.1.0/24.
After researching a bit on the Internet, it seems that connections from the GuestPC's are able to masquerade on my ADMIN network because of NAT on Router 2. Thus, given only the above ufw rule, GuestPC's are able to fully access the Samba and SSH services without restriction.
My question is, what is the proper way of preventing the GUEST network (192.168.2.X) computers from accessing the ADMIN network (192.168.1.X)? Is there a better way than setting Router 2 to static IP and blocking its IP using ufw on the Ubuntu server?