4

As an example, I have 3 computers on a home network: Machine A Machine B Machine C

What I would like to do is isolate "Machine C", so that it cannot communicate with "A" or "B" and vice versa. It should be an entirely separate entity.

Let's say I'm using a Linksys E4200. Is there a good way to configure the above scenario with the default firmware? Is it possible with non-default firmware such as DD-WRT or Tomato? I do not have experience with this but have no problem learning.

My understanding is that this can be done by placing "Machine C" in the DMZ. Unfortunately, I am told a lot of home routers do not have a secure way of setting up DMZ by default. The two routers solution can work but still requires restricting administrative access from "Machine C" and adds an additional potential point of failure.

EDIT:

From the sound of things, to have proper firewall rules in place I need an additional router.

11
  • 1
    What type of OS is machine C running? Mar 19, 2013 at 15:35
  • 1
    I don't mind if Machine C is compromised, I accept that risk. The intent is to ensure that Machine A and Machine B are protected from a compromised Machine C. As per the other answer I think firewall rules may be the way to go, and I'll investigate subnetting for my router. Mar 19, 2013 at 15:51
  • 1
    @rakemanyohneth yes, you have another router that's a firewall, creating a pocket between the two firewalls, called a DMZ. Mar 19, 2013 at 16:00
  • 1
    Yeah. More professional-grade network setups tend to have a separate computer serving as a router and firewall; it connects to multiple networks, and regulates what traffic flows between them. A DMZ there could either be a second LAN hooked up to the firewall (for a total of 3 networks: two LANs and a WAN) or two firewalls (one between WAN and DMZ, one between DMZ and LAN).
    – cpast
    Mar 19, 2013 at 16:01
  • 1
    If you are willing to set up another computer, you could drop an Ubuntu build out there with two NICs in it and use ufw help.ubuntu.com/community/UFW. It uses iptables and is very customizable. en.wikipedia.org/wiki/Iptables
    – kmort
    Mar 19, 2013 at 17:37

2 Answers 2

3

You need to put machine C into its own network range. It is the best way to isolte the machine and protect your other machines that live on thier own IP range. The only problem is that you might need an extra router with DHCP and WAN port or a switch that support NAT. Possibly manually configuring PC C will also work. Essentially creating two networks.

enter image description here

Your main network (default out of box)

  • WAN IP: Pulbic IP from ISP
  • IP LAN: 192.168.0.254 (routers IP)
  • DHCP : 192.168.0.254 (192.168.0.y - 192.168.0.z)
  • GATEWAY: 192.168.0.254

Your protected network (tweaked)

  • WAN IP - 192.168.0.x (From DHCP Second router)
  • IP LAN - 192.168.1.254
  • DHCP: 192.168.1.254 (192.168.1.y - 192.168.1.z)(for 2nd network)
  • GATEWAY: 192.168.0.254 (Route to Internet only)

Manual

In your E4200 Manual on page 9 there is a section about advanced routing. This might be a solution or method to help you create separate networks. Ideally, newer routers offer Virtual Networks and things like that help you manage this better.

Alternatives

This is advance- but it is one of the preferred one for all good sysadmins!

You can replace your current router with an advanced pfSense compatible router or PC. It can(and should) completely replace the router from your ISP. You need to look at the compatibility list and select a router of your liking. It requires you to install pfsense to it which is FreeBSD. The info says it for use as a firewall and router. Router is what you are interested in. But it does a whole lot more!

You can install proxies, squid, throttling, dns, etc. pfSense allows you to create as many networks and you can configure them how ever you like!

enter image description here


Using firewalls on the computers them self is not the resolution to the problem. I t can give you a false sense of security but firewalls are designed to protect incoming connections to a given computer. Blocking standard ports will cause unexpected long term complications for things that were designed to make life easier!


--Edit added after answer accepted.

Some external reference where 2 sysdamins on Techsnap 101 agree that firewalls are not the answer in protecting computer from each other. Fast-forward to the end bit. Also how to isolate a machine from the network using a VLAN, NIC or Routes for the very exact question you asked here

14
  • That won't work, unless you manually adjust routing rules on the PC. The PC needs to know how to reach the gateway, and the only things it knows how to reach by default are the machines on its subnet.
    – cpast
    Mar 19, 2013 at 16:02
  • 1
    Yes I said that- He might need another switch or router. You just being spiteful now. This is the industry standard for Isolating computers on a network. Trying to get some homebrewed hackish methods is really bad advise.
    – Piotr Kula
    Mar 19, 2013 at 16:03
  • Industry standard is to use one or two dedicated firewalls. It's not just to change the IP range. With a second router (a switch will not work), this would work, but you need to configure that router's firewall to make it actually keep C off your standard network. Unless you have a firewall between C and A/B, they aren't isolated.
    – cpast
    Mar 19, 2013 at 16:08
  • 2
    It sounds like to ensure a secure isolation, I need an additional router in between the two networks. Mar 19, 2013 at 16:37
  • 1
    Hi ppumkin, for the above diagram, would the configuration be set up to allow traffic from the second router to the first, but not allow it if the destination was Machine A or Machine B? Edit - The pf suggestion from cpast and ppumpkin is something that is worth looking into, thanks! Mar 19, 2013 at 16:57
2

The first thing that came to my mind is a firewall.

You could make firewall rules on Machine C that don't allow any TCP connections to or from 192.168.x.x (or whatever your local LAN is configured to use) but allow other outgoing connections. You would need to specifically allow connections to your router though. Of course you'd need to be able to lock down this configuration so that no one can change the firewall rules.

In this case you can also change the firewalls on Machines A and B to not initiate/receive any packets from Machine C as well.

I'm not good at ASCII art but you could also pick up another router. Call your current router R1, and your network is 192.168.1.x. Pick up R2, make it a client of R1, and machine C a client of R2, by itself, with network 192.168.2.x. (Machines A and B are still on R1, 192.168.1.x). Play with the firewall on R2, allowing 192.168.2.1, but rejecting anything else 192.168.x.x. This should cost you about USD$50 or so, plus some time. You essentially create your own DMZ. Machine C is now Double-NATted, which may be good or bad, depending on what it's doing. If it's a server, you now have to allow connections from the Internet through R1 and R2. Firewalls on Machine A and B would be set for 192.168.2.x. You can still firewall Machine C, but then you still have the hardware firewall on R2 if it gets compromised.

BTW: Replacing the stock firmware on an E4200 may be good for other reasons. Some firmware versions allowed Cisco to "cloud manage" it. Also, Im not sure if you can turn off WPS (which has been broken) through the stock firmware. If you do this, can you comment and let me know how this works? My uncle has an E4200 I was going to reflash in my infinite free time.

16
  • That's one of my main concerns, I'd need to be able to restrict a compromised Machine C from changing that rule. Mar 19, 2013 at 15:40
  • Firewall rules would be the best way to deal with this.
    – MDT Guy
    Mar 19, 2013 at 15:46
  • I'm not sure if my E4200 allows creating different subnets and I'm not currently at home so I can't check, but do you think having Machine C in a separate subnet and having firewall rules would do the trick? Machine C will be a desktop PC so we don't have to worry about re-configuring the rules, thankfully. Mar 19, 2013 at 15:52
  • If Machine C is compromised, aren't all firewall rules on machine C at risk? I don't see how you can rely on a security feature on a compromised machine.
    – cpast
    Mar 19, 2013 at 15:54
  • -1 Firewalls are used to block unauthorised access. Not isolate machines!
    – Piotr Kula
    Mar 19, 2013 at 15:55

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .