Isloate Two Networks

Question

Level 1

19 points

Isloate Two Networks

Hi all,

I have a couple of networks in my workplace, one is on a DMZ and is isolated from the rest of the network, the other is on a general office LAN. I'm looking to set up a server that needs to be accessible to other devices on the DMZ (to access content) and to devices on the LAN (for configuration/set-up).

If I connect a Mac with two NICs to both the DMZ and the LAN, is there a way to guarantee that devices that connect through the DMZ won't have access to any devices/content on the LAN.

The server will be a Mac mini running Lion, if anyone can suggest a way to achieve what I need to do I'd really appreciate it!

Posted on Nov 5, 2013 5:35 AM

Reply

Answer 1

Best reply

Linc Davis

Level 10

209,547 points

Nov 5, 2013 8:36 AM in response to Spielo

The server will not automatically forward traffic between networks, so you don't have to do anything special.

Reply

Answer 2

Spielo Author

Level 1

19 points

Nov 5, 2013 8:58 AM in response to Linc Davis

Great, thanks!

Reply

Answer 3

Nov 5, 2013 11:03 AM in response to Spielo

Even easier: get rid of the DMZ.

If you're allowing connections from the DMZ into the private LAN, that may well result in an "escape path" from the DMZ into the LAN, whether through the data access path or due to some other weakness in the security of that computer.

While Linc is entirely correct as far as the default behavior goes, attackers very seldom keep servers at the default settings. Minimally, run a port scan from somewhere within the DMZ and see what TCP and UDP ports open on the bridging computer.

Reply

Answer 4

Spielo Author

Level 1

19 points

Nov 6, 2013 8:44 AM in response to MrHoffman

Thanks for the further info. I spoke to our network admins and they said the same as you, but we're going to do the opposite thing :-)

We're going to only connect it to the DMZ and then just forward select ports for HTTP and SSH through to the LAN.

Thanks again.

Reply