0

First of all, I present you a diagram, as single picture is apparently more worth than single word: network scheme

On the left side of the green dashed line is the network I do have currently set up at home.

Now, imagine that I want to connect another, single PC to that network. However, this PC is outside my apartment and this can't be done just using WiFi (too far away, PC is not in range of my WiFi). I can, though, put a cable (about 45 meters long) from this computer to my apartment. PC itself is located in place that only I have access to, but the cable would be then placed in places that any ordinary (3rd party) people have access to (kind of shared basement).

So, I have just realized, that unlike WiFi, connecting this PC with cable will immediatly open access to my LAN when, for example, some hacker will cut my cable and then connect his computer with it. My network will give him an internal LAN IP address and he will be able to sniff around in my network without my knowledge, accessing resources that I do share just within my LAN (from NAS for example).

The main question is:

Do you know of any way to make this connection safer? I.e. to eliminate the risk of letting hacker into my LAN by just plugging my LAN's cable into his laptop?

Below you can find some (probably) less important facts:

  • router with OpenWRT is coloured blue on the diagram
  • wired connection are these with solid black lines
  • wireles connection are dotted black
  • WiFi bridge in conjunction with RPi (Raspberry Pi) is optional but very possible way to attach the "insecure" segment of LAN. I thought that some solutions could make use of this, so I put them on diagram. If not - one can replace it with just another wired connection.
Improve this question
2
  • The OpenWRT platform supports many network configurations including VLANs and firewalls. I would check to see if it also supports white-lists or MAC filtering, so only authorized MAC addresses are allowed to connect to ports. While this is not a bulletproof solution (a MAC can be spoofed) it is one more thing you can do to protect your internal network.
    – 0xSheepdog
    Apr 23, 2017 at 3:39
  • Consider using IPSec between your secure network and the remote machine. You should also have a firewall between the secure network and the remote machine so that you can control exactly what traffic is allowed into your private network. Further, the remote machine should only accept the IPSec connection; that way if the cable is compromised it won't accept attempts by an attacker to gain access to it.
    – I say Reinstate Monica
    Apr 24, 2017 at 2:29

0

Reset to default

You must log in to answer this question.

Browse other questions tagged .