3

we have a Linux based Local Area Networking, Please find the below architecture diagram

enter image description here

we have server and client machine connected to through network switch, When any request comes from client we able to block the request in server (192.168.12.10 ). But but client 1 gives the request to client2 any Tcp/IP request we can't control and we can't block in the server , Whether is it Possible ? If its possible please solve my problem. Server side blocking I am using iptables.

Examples :

Client1 trying to connect clinet2 using 22 port, now I want to block clinet1 request in server its self ( 192.168.12.10 ) , not in client, I want to manage all the client request in the main server.

Edit: I want to route all traffic through my server(192.168.12.10)
Client1 -> SSH -> Server -> SSH -> Client2

  • You mean you want to route all traffic through your server? Client1 -> SSH -> Server -> SSH -> Client2? – Lenniey Mar 9 '17 at 8:18
  • You would need to block traffic between clients on the switch if you want to manage centrally. Use switch ACLs, but if you have all the clients on one network segment they CAN bypass the server and talk to each other. So you need firewall on each client. Hence my answer below :) – bao7uo Mar 9 '17 at 8:19
  • @Lenniey,Exactly what I need. – Ganapathy Mar 9 '17 at 8:21
  • @PHPaul,No of clients are huge , so we can't control in clients , We need to restrict switch level or server level. – Ganapathy Mar 9 '17 at 8:26
  • 2
    Whatever original problem you are trying to solve with this idea, this is not the way to do it. – yoonix Mar 9 '17 at 8:50
3

If the clients are also running Linux, you should also be able to block them using iptables.

For example, on client 1 if you wish to block all incoming TCP IP traffic from clients 2 and 3:

iptables -I INPUT -s 192.168.12.2 -j REJECT
iptables -I INPUT -s 192.168.12.3 -j REJECT

and on client 1, if you wish to block all outgoing TCP IP traffic to clients to and 3:

iptables -I OUTPUT -d 192.168.12.2 -j REJECT
iptables -I OUTPUT -d 192.168.12.3 -j REJECT
| improve this answer | |
  • Good point, have amended. Also, you can use "DROP" instead of "REJECT", but in a LAN scenario it will probably be better to say "REJECT" to avoid longer timeouts in any applications. – bao7uo Mar 9 '17 at 8:09
  • @PHPaul,Thanks for your response, But my requirement is , client1 trying connect to clinet2 I want to block in the server that mean 12.10, Refer my diagram – Ganapathy Mar 9 '17 at 8:11
  • I know - should have been in the answer, rather than a comment :-) – bao7uo Mar 9 '17 at 8:13
  • @PHPaul,See my updated question. – Ganapathy Mar 9 '17 at 8:14
3

You can not simply control the traffic between your clients in the setup presented in your question. This is because clients can directly talk to each other without passing through any router or firewall. Your clients are attached to the same subnet (assuming /24 mask).

If you want to control the traffic through some router/firewall, you need to change the subneting of your network. Each client has to be in its own subnet/VLAN. So, it needs to talk to its gateway (your server) when it needs to talk any other client.

There are other unclean options like ARP spoofing.

| improve this answer | |
0

There is no pass-by filtering solution in linux. So your server needs to be a transparent bridge sitting between your switch and router. Otherwise you won't be able to control clients internet access.

Solutions you can try:

  1. windows pass-by filtering solution. http://www.imfirewall.us

  2. linux transparent bridge. Then you can use iptables and tc for blocking and bandwidth shaping.

| improve this answer | |

Not the answer you're looking for? Browse other questions tagged or ask your own question.