0

Currently I am working on designing a network. The problem is that at a certain point I got confronted with a weird request. The client has made some thoughts of her/his own. Now I am troubled because my knowledge in this matter is not deep enough. I cannot pin point whether there are inherent problems with the request on its own and if there are how to convey them to the client. The request applies to two servers in particular and is as follows:

Physical Network(simplified):

router.eth0 <--> switch.eth0 | switch.eth1 <--> server1.eth0 | server1.eth1 <--> server2.eth0

Logical Network:

+----------+      +----------+      +----------+      +----------+
| router   |      | switch   |      | server1  |      | server2  |
| untagged | <--> | untagged |      |          |      |          |
+----------+      | vlan 10  | <----+----------+----> | vlan 10  |
                  |          |      | untagged | <--> | untagged |
                  +----------+      +----------+      +----------+

So every request from the router is first tagged to vlan 10 and send to server1. server1 then forwards those packets onward to server2 while server1 is not reacting to vlan 10 packets. After that server2 untags the packets from vlan 10 and depending on the packet's content forwards some of them back to server1 or process them itself. Finaly server1 can respond to those packets as they are now untagged.

To preempt some suggestions: I know that it would be easier to just connect server2 directly to the router and server1 to server2 but the client insists on going that way if there are no security problems with this approach. The client also sets it as a requirement that all packets directed at server1 have to be processed by server2.

My problem now is whether an attacker could compromise this setup. So that if he gains control other the router. Can the attacker use the flow of packets through server1 to his advantage (exluding denial of service)? Could the attacker for example forge packets which could be directly addressed to server1 and to not flow through server2?

1 Answer 1

1

If everything is configured exactly as depicted, attacker shouldn't be able to forge packets or otherwise reach server1 directly. It is possible to configure it securely.

But this setup still has serous flaws:

Most important, it is too complex. While it is possible to configure it like this, why purposely configuring like this? What is the intent of adding complexity, why doing things more complex than they need to be? It is sometimes said that quality of design of computer systems is measured in WTFs, the more WTFs will ask the auditor, the more unexpectedly complex the system is (i.e. less good the design); this is exactly the case, WTF is this?

Secondly, this setup introduces a point of failure which makes a system harder to diagnose and repair. Observe that failure on server1 will make server2 inaccessible, even if it is perfectly working; failure of server2 will make server1 inaccessible too, even if it is fine either. You can't really distigush these two cases. Imagine you faced a situation where you have both servers inaccessible. Which one do you think is failed? You can't give any approximate directions to diagnose and repair system early. You would need to carefully inspect everything right from the beginning, and nothing could be done remotely. This way it needs an extra unjustified maintenance. Do your client likes to pay more for that extra work, while this expense could be easily avoided (or at least made less probable) by proper network design?

Also, this setup is quite fragile. Other possible setups could justify some mistakes; this one will display breaches if a single mistake is done in non-obvious place. It is not apparent to some new employee who just faced this type of setup what should be enabled and where. You need to really carefully configure VLANs on server1, for it not to accept untagged packets from switch side. If it accepts by mistake, the setup is flawed and the condition server1 is not reachable other than through server2 doesn't holds anymore; this creates a hole for forged packets.

Finally, it has an inefficiency, that could possibly lead to DoS. It is normal to expect both links are 1Gbps. We don't know which kind of service is going to be run on server1, but for simplicity I'll depict a simplest case it has a symmetric typical traffic distribution: amount of incoming traffic approximately equal to amount of outgoing traffic. In that case, link server1-server2 will always be loaded two times more than link switch-server1. When load on the link switch-server1 exceeds only 50% of its capacity, and if all that traffic is expected to reach server1 through server2, link between servers will exceed its capacity and packets will get dropped. Also, server1 must bridge networks, it would be done by CPU; it is not very high load, but still it generates interrupts, context switches, so server1 must do some completely unneeded work. This is type of setup goverments always liked, it keeps their employees busy while not doing any useful work, just shuffle paper back and forth.

All of these problems of course go away if servers are connected in the "correct order" and without VLANs. There could be also a star-like network topology, in which case all devices (router, both servers) are connected directly to the switch, and all VLAN processing then to be done on the switch. Star-like is "kind of" free of some of these problems too; it only has described problem of link overload, but it easier to solve in this case and it is naturally easier to securely configure VLANs on a switch than to do that on the server.

2
  • The client mentioned that the complexity is intended and should just be checked for security but does not want to disclose the reasons. As I know the client for some time I assume it hast to do something about virtualization. Therefore server1 is probably the hypervisor of server2 and thus already a point of failure for server2. So the throughput of the diagram would be a virtual switch. As securing a host through a VM is also a WTF and this is only speculation, I do not think the client would disclose whether this is true or not.
    – CodyMouse
    Jan 17, 2021 at 18:25
  • That's true. I missed the fact that in case of virtualization you'll get essentially this type of network. But then the problem of unavailability of server1 when server2 is down is even more important. I am sure the host must be available even if no VMs could be started, at least for monitoring and maintentance. In that case it is better to move all network security duty out of servers to the router, instantiate VLANs there and run server and VMs in different VLANs. Or, at least, in some cases I'd rather instantiate two virtual NICs than to bother with VLANs. Jan 17, 2021 at 19:40

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .