As I understand it, the hosts on different subnets cannot communicate with each other unless there is a router somewhere on both subnets that forwards traffic between them.
I have have two subnets on a network, say: 192.168.0.0/24 and 192.168.1.0/24. I want to creating a firewalled route between them, using a linux box connected to both subnets. The firewall would be implemented in iptables.
All hosts connected to the network will be trusted, and users would not have admin rights to alter their networking configuration (i.e. to just connect on the other subnet).
Assuming everything I said above isn't complete nonsense, what are the possible ways in which a user connected to one subnet, could bypass the firewall and gain access the other subnet?
Obvious ones that occur to me are simply connecting an untrusted host.
To clarify: What I'm attempting to to is create a custom firewall solution (not off the shelf). It is to be integrated into an existing solution, which already runs on a linux box, so that side of things is fixed.
The firewall would allow the definition of zones, based on either physical NICs or VLANs.
It seems to me, that physical LAN based zones are susceptible only to someone physically connecting to the network that they are not supposed to. Encryption aside, that comes down to physical security at that point. Assuming you've not misconfigured a switch somewhere to expose an endpoint carrying dot1Q traffic, or to allow a VLAN hopping attack, the VLAN based zones are essentially the same.
The root of my question is whether or not subnet based zones (running on the same physical hardware) can be added to the list of things that can be feasibly firewalled. This would rely of course upon the all the connected hosts being "trusted", and all the users (to which the firewall applies at least) not having administrative rights to mess with network settings.