0

In my local network, all PC's are connected in the same subnet (192.168.0.x).

enter image description here

I have a machine which is connected to switch B and it has been assigned with a static IP (e.g 192.168.0.10). Any PC in the same local network can access it from the browser and see its menu. What I want is to limit the access to it, so certain PCs to be able to reach it.

How can I do this? For example I want the IP 192.168.0.10 to be visible only to PC with IP's 192.168.0.5 and 192.168.0.6

The target machine(192.168.0.10) is a machine (in a factory) where I don't know what Web Server is running and if I can edit it settings..

Can I add a setting in the router?

4
  • You would use a firewall on the webserver host. The question is too vague to give a more specific answer. If you add your OS, someone could create a proper answer for you.
    – mtak
    Jun 19, 2017 at 11:03
  • If the target machine is connected to switch A, by design there is nothing you can do to prevent computers from switch A to connect to it, unless you create another subnet. I am not even sure you could prevent machines from switch B to connect to it either (depends on the router). Jun 19, 2017 at 11:25
  • You need separate subnets then. If security is a concern, they need to be physically (or at least via VLANs) separate, too.
    – Daniel B
    Jun 19, 2017 at 11:41
  • Understood @DanielB Please post it as an answer to take the credits
    – yaylitzis
    Jun 19, 2017 at 11:42

2 Answers 2

1

The most usual solution is to use the target's firewall. Here the "target" would be the machine with IP 192.168.0.10. You need administrator access to this machine.

What you need to do is one of those:

  • block all incoming connections originating from IPs that must not acces to the target
  • allow only incoming connections originating from IPs that can access the target

E.G. on a *NIX machine, using iptables:

iptables -A INPUT -s 192.168.0.5 -j ACCEPT
iptables -A INPUT -s 192.168.0.6 -j ACCEPT
iptables -A INPUT -m conntrack --ctstate NEW -j REJECT --reject-with icmp-host-prohibited

Note that your question is extremely broad, so this answer may not be applicable.

EDIT: given the additional info, this answer is not applicable.

1
  • You can always remove your answer. :)
    – Daniel B
    Jun 19, 2017 at 11:41
0

Unfortunately, there is no way to do this on the router: there is just one subnet, so any traffic goes directly between the PCs, not through the router.

Your best option is to follow Nathan Shiraini's instruction and limit traffic on the target machine, rather then router.

Sure, there are other possibilities, i.e. add another subnet and route packets to that subnet through your router, but those are greatly depend on you router capabilities.

If the router you have is a casual home/small business router, most probably you will not be able to implements that scenario. If your router has few L3 (routing) interfaces or a dedicated DMZ port, or you are not using your WAN port, you might be able to connect the machine to that port there and limit traffic on the router.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .