0

I have built a test environment I want to isolate from my production servers.

As part of this I want to prevent my new server from accessing file/network shares on production. For example prevent it from accessing \\MyProdServer

I updated my host file with 0.0.0.0 MyProdServer

However this doesn’t work I can still access the files. I do not have firewall available nor do I want to edit my production server in anyway.

  • the server is running a web service, this web service tries to save files to a share. I have updated the config to point to a new share. Put it is possible that the old config is put back on to the server. In which case want to ensure the system will not automatically copy files to production – Daveo Jun 27 '13 at 1:27
  • How do you not have a firewall available? – Nathan C Jun 27 '13 at 1:29
  • I was about to ask the same question, @NathanC. – EEAA Jun 27 '13 at 1:31
  • we want test server to be identical to production. Production does't use a firewall (at the moment) that is another issue. – Daveo Jun 27 '13 at 1:37
  • @Daveo The only way you're going to get this to work properly is with a firewall. Even if you have it up to only isolate it. – Nathan C Jun 27 '13 at 2:07
0

Well, there are many ways to skin this cat. The most obvious way would be to have tight deployment practices and never allow credentials for the production server to get deployed to the test environment.

Second option - create egress rules on the test environment's firewall that blocks all traffic to the production server.

Honestly, if you're that concerned about this, the two environments really should be on separate networks, separated by appropriate network ACLs.

| improve this answer | |
  • We have tight deployment practices however we do a sync every 24 hours from prod to test to it could one day potentially brake and somehow override local settings. With the firewall the production server doesn't have its firewall on and we want the test server to match production as much as possible. And do not have time/approval to change production at the moment. Looking for something quick and simple Again we do not have budget for seperating networks. Looking for a 5 min solution. – Daveo Jun 27 '13 at 1:35
  • 1
    Well, something is going to have to change. With the constraints you specified, the most foolproof way of doing this at the moment is one of the two options I specified. You don't have to change production. Set a firewall rule on test and be done with it. – EEAA Jun 27 '13 at 1:39
  • 2
    Also, your "might someday brake[sic]" clause is problematic. There are thousands of things in your environment that "might someday break". Do you feel the need to account for each and every one of them? You have a problem right now that needs a solution. So solve it as best you can now, and then revisit when you have the time, say, to put in a proper network. – EEAA Jun 27 '13 at 1:42

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.