Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have multiple computers on an insecure network (with third party, untrusted computers). My computers and the third party computers are all behind the same firewall.

Currently my computer's software firewalls are configured to block all traffic from other computers on the network. Unfortunately this does not enable my computers to talk with each other. I would like to modify the setup in such a way that my computers can communicate securely, but no third party systems can impersonate one of my computers or eavesdrop on the communication between my computers.

The problem:

  1. I cannot modify the firewall that all of the computers are behind
  2. I cannot use static IPs

Can this be done using a VPN or maybe a second hardware firewall? If not, is there some other solution?

I have full administrator access to all of my computers and can add any needed hardware. All of my computers are currently using Windows 7.

share|improve this question
up vote 3 down vote accepted

VPN sounds as the right solution to your issue, make sure to select one that does not depend on static IPs (the technology should depend on static IPs, but rather on installed certificates, but since static IPs are simpler to configure, it can't be assumed that a given VPN does not depend on them).

A second F/W or other routing based solutions would be a difficult proposition because of the static IP issue.

share|improve this answer
How would the firewalls be configured on the clients? Assuming I use OpenVPN and certificate-based authentication, would it be as simple as instructing the server's firewall to allow OpenVPN to accept connections or would there be more advanced configuration requirements? – HardwareWoahs Jun 19 '11 at 6:16
@HardwareWoahs: It would be enough. – grawity Jun 19 '11 at 8:32
I will be accepting this solution and will use a third party service to coordinate the VPN server's internal IP address with the clients. Thanks! – HardwareWoahs Jun 19 '11 at 15:28

I am interpreting your question in my answer here (rather than edit its statements).
This way if I am mis-interpreting, you can help fix with comments (and I'll update my answer).

  1. You have admin rights to a group of computers (refer them as group 'X')
  2. these are behind an Internet facing firewall
  3. However, there are other computers here that you refer as 3rd party (call them group 'Y')
  4. You do not have useful access on group Y machines
  5. You want to secure group X machine communications

You requirement appears like typical service environments taking contract work from different sources with the need to partition all activities across the sources. So, each contract related set of machines would see all other machines as 3rd party. However, you have trouble doing this partition physically -- probably, because the dynamic nature of the contract work; it would imply frequent change in the setup.

You might also be in a leased environment with other people sharing a common perimeter security.

Another analogy is a defence-network.

You could look for MACsec based solutions that will secure your network communications.
These will be deployed only on your (group X) machines -- the rest of your internal network will be transparent to this. However, you will need some way to communicate with devices outside your group X. This could be some gateway device or a way to communicate w/o MACsec from these machines.

share|improve this answer
You have interpreted the question correctly. I will likely explore the VPN solution because it seems as if it would involve less setup. MACsec seems like a good standardized solution if I had a larger or more dynamic trusted group. – HardwareWoahs Jun 19 '11 at 15:23
@HardwareWoahs, correct approach. – nik Jun 20 '11 at 4:27

One possible solution built into Windows is IPsec, which supports authentication with X.509 certificates, pre-shared keys, or Kerberos.

share|improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .