In a small network(in my company), I would like to block some computers(PCs) to access the internet, so that sensitive data or files in those PCs can not be leaked. But I still need users of the PCs to access the internet through remote desktop.

Here is my network topology of the company. (See image shot below) block pc access to internet

The main design points are:

1, the PCs have some sensitive data and files, so access to internet is blocks by the Router. (the Router has a simple firewall which can block the connection to internet through a mac address black list) But the PCs can access to LAN.

2, I have a server computer which is running Centos, and I have created a VNC server and a FTP server on the server.

3, to access the internet, the users can SSH from PC to the VNC server, and open the browser in the VNC remote desktop(the server is allowed to access the internet), if the the user would like to download some files, he can first download the file in the server, and put the file in the FTP server.

4, from user's PC, he can download the files through FTP from the server.

Note1: the VNC remote desktop is not allowed to transfer files, so that files can't be transferred from PC to the servers. The FTP server is read-only, which means files can only be transferred from server to PC.

Note2: I would like to add some iptable rules in the centos's firewall so that the server can only accept the VNC connection, and the sever is not allowed to access the PC. (I mean if the PC can simply run a HTTP file server, and then server can download the file from the PC to server, but this behavior should be blocked by the server's firewall)

My question is: Is this way secure? All what I want to achieve is that I want the data/files in PCs never get leaked, but I still allow users of PC to access the internet through remote VNC desktop. And data are only allowed go this way: from internet to server, then from server to PC.

Any other ways to achieve this?

  • Why not invest in getting some DLP software instead? What's stopping someone putting a document on the FTP and then sending it out? What about USB, or burning a CD? – Zapto Jun 27 '16 at 8:26
  • You mean en.wikipedia.org/wiki/Data_loss_prevention_software ? It is not easy for a DLP software to protect the data. We have Windows, MacOS and Linux systems, and many softwares are used. The important and sensitive data are all in PCs, and the PCs can't upload files to FTP.(The FTP can only download files). And we can seal on all the USB ports, and the PCs don't have any CD drives. – ollydbg23 Jun 27 '16 at 8:35

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.