0

Server is connected two two separate, isolated subnets via two physical nics. Is there any way the server can act as a gateway for the two networks to communicate? To clarify, I don't want any communication. The goal is just to provide the same web services to both subnets from the server only, without allowing it to connect the two in any way.

Network A is a typical office LAN. Network B is in the same building but isolated. No internet access, nothing. It needs to remain that way for a variety of proprietary reasons. Users developing software must upload it to a subversion server via N A. Technicians on N B must be able to access the subversion files. My switches on both subnets are Procurve 2810 ...no ACL support I don't think.

Improve this question
2
  • Are these two subnets physically isolated or two vlans? I am trying to understand the security requirements here, if you are providing identical services would a collection of ACLs not be more appropriate? By default most servers do not act as routers, but most can if configured to do so, either maliciously or accidentally.
    – Acyclic Tau
    Jan 15, 2015 at 7:09
  • Original question edited for clarification.
    – Tedwin
    Jan 15, 2015 at 7:20

4 Answers 4

Reset to default
1

As you describe it, you don't actually want the server to be a gateway. An IP gateway is a host that forwards traffic for the local network segment to other hosts that don't reside on the segment. It's only a gateway if it is routing traffic, which you've stated you don't want it to do. Don't enable forwarding or bridging.

However, you can run the web services or subversion on both IP interfaces. As long as the address for the interface is on the same subnet as the client, the client won't need a gateway. You just need to configure the web server to listen on both interfaces.

Improve this answer
1
  • Okay, that is the current config and I am glad to have a few telling me I am go to go like this. Thanks Mark.
    – Tedwin
    Jan 15, 2015 at 16:14
2

Server is connected two two separate, isolated subnets via two physical nics. Is there any way the server can act as a gateway for the two networks to communicate? The goal is just to provide the same web services to both subnets from the server only, without allowing it to connect the two in any way.

The server doesn't need to be a gateway. Just bind subversion to both NICs and have people connect to subversion at the respective server NIC ip address.

Improve this answer
1
  • I don't think you read my question very carefully.
    – Tedwin
    Jan 15, 2015 at 15:33
0

If IP Forwarding is not enabled in the OS, it will not route packets between networks.

Improve this answer
0

This is easy to achieve: Give the server two NICs. Connect one to subnet A and the other one to subnet B. And then make sure, that "IP forwarding" on that server is securely disabled! In addition to: echo 0 >/proc/sys/net/ipv4/ip_forward you can also set the default rule of the FORWARD chain to drop: iptables -P FORWARD DROP Check your specific OS instructions on how to achieve these. Usually, the 0 into ip_forward is the default anyways, though.

Improve this answer
1
  • Thanks Kai. I like your idea of explicitly dropping packets that somehow make their way through.
    – Tedwin
    Jan 15, 2015 at 15:35

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .