11

I have a very paranoid client who runs two separate networks (one offline, one online) with separate PCs etc.

I have a challenge in that I have written an application for them that will run on the offline network however the network needs to be able to send emails to clients. My idea is to have a one way network connection (like a diode) from the offline server to an online PC that would send the emails.

What is the most effective way to go about this that is semi cost effective? Can I get a one way network card?

Windows Server 2008 Network, Windows PC.

6
  • 1
    SMTP is, by definition, a two-way protocol, so you'll never be able to have a true one-way communication. The sending server will always need to receive acknowledgement back from the recipient that the mail was received correctly.
    – EEAA
    Dec 16, 2011 at 22:13
  • 3
    How about UUCP via sneakernet?
    – EEAA
    Dec 16, 2011 at 22:16
  • 1
    Better is to use IPoAC as the sneaker wearer can be bribed. See: en.wikipedia.org/wiki/IP_over_Avian_Carriers Dec 16, 2011 at 22:37
  • Avian carriers can be bribed too.... You just need some bird-seed :-)
    – Tonny
    Dec 16, 2011 at 22:44
  • 1
    @ErikA is correct: if you want a literal one-way transfer, UUCP is the time-tested way to deliver messages to the internet from offline computers. Use write-once media (e.g. CD-R discs) if you want to be really sure that you have data moving in only one direction.
    – Skyhawk
    Dec 17, 2011 at 3:04

7 Answers 7

18

Basically you just need a firewall between the two with really tight rules, basically something called a 'Deny all' rule and then just allow a single one way point to point single port outgoing rule for what you need. This is easy for a security/network guy and should be satisfactory for your client.

11

I wouldn't exactly call them paranoid, and I applaud their attitude to security.

If they've gone to the trouble of separate networks, they've probably also gone to the trouble of installing a firewall. A small hole in the firewall which only allows traffic on port 25 to pass from a specific IP address in your offline network to a specific IP address in your online network should do the trick perfectly.

1
  • 7
    Or even better: from a specific mac address. Or even better better: From a specific mac address authenticated by 802.1x
    – pauska
    Dec 16, 2011 at 22:41
7

I would use a serial link that has only the GND and TX on the secured server and GNS and RX on the unsecure network. No flow control as this can be used to leak information from unsecure network to the secured one.

I would create a small SMTP-UDP-SMTP proxy that is composed in 2 daemons. SMTP2UDP and UDP2SMTP.

SMTP2UDP will be a uncompliant MTA that will run on the secure network and accept emails that will send using UDP on the serial link.

UDP2SMTP will run on unsecure network and accept emails via UDP and send them to a real MTA.

On the serial link I would use an optocoupler to make use of the diode in the requirements.

4

If you wanted to implement the requirements to the letter, you could use a one-way IP link that sent its emails via UDP (or a similar unidirectional protocol) to a custom daemon that listened for these packets and sent them out via SMTP to the intended recipient.

Of course, the sending (offline) system would have no idea if they actually went out or not. For this acknowledgement to happen, you need a minimal firewall setup as Ben and Chopper3 have answered.

1

The TCP protocol needs two-way communications. This setup sounds similar to a DMZ design, where your app runs in the trusted intranet, and the mailserver and/or recipients exist in the untrusted DMZ zone.

A well-configure firewall will be able to only permit connections to be initiated from the trusted intranet, and not the other way around. If that is not enough, I doubt any physical connection between the two networks will satisfy your client, which means you won't be able to send mail automatically.

4
  • 1
    IP does not require two-way communication.
    – MikeyB
    Dec 16, 2011 at 22:18
  • 1
    He was referring to TCP. SMTP is working only trough TCP. And TCP requires 2 way communication. I will edit his answer. Dec 16, 2011 at 22:24
  • SMTP needs two way communication. One way for the outbound SMTP commands and the other way for the inbound SMTP responses. The responses from the target SMTP server/process need to be able to reach the SMTP server/process on the source. Since the source server will use an ephemeral port for outbound connections you'll need to configure the source server to always use a predefined port to initiate outbound SMTP communication. That way for firewall rule is locked down to a single source port and a single destination port.
    – joeqwerty
    Dec 16, 2011 at 22:34
  • Nothing in the question requires SMTP. There's more than one way to send mail.
    – MikeyB
    Dec 17, 2011 at 4:23
0

If they've gone to this extent to separate the networks, there should be two firewalls in place here with a mail-enabled box in the middle. On the offline side, only allow connections to this box to dump messages to send via your custom app. On the online side, only allow the smtp connection to the mail server.

You could do the same very cost effectively with a single dual-homed box with software firewall running on each interface but having things separated out will create several additional layers of protection and would be preferable.

0

I would just have two mail servers, an internal and an external. Have the servers continually append outgoing emails to a file, and every so often rename the file, copy it on a USB key, and drop it in an incoming folder on the other server. This is how many installations perform air gaps in network servers.

If it's too important to delay, it can be sent from one of the outside clients.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .