How to prevent any computer that is not joined to the domain from requesting any service from my network? Considering that the computer is on another network.

  • If the hypothetical attacker is on another network, you should be able to block access with your external firewall. If the hypothetical attacker is on your own network, uh, theoretically I think IPSec should be able to do this? – Harry Johnston Jul 18 '18 at 1:44

I guess this is not possible on the TCP/IP level. You could either secure every single service using AD authentication. If a service doesn't support this natively, you can try using a proxy (e.g. SOCKS) that does. Another approach would be on a deeper level, by using 802.1x port-based authentication on the switches. This will require a machine to authenticate itself before the switch "opens" the port. Unauthenticated machines will have no network connection, also no Internet access. It should be possible to use AD as a Backend for authentication. You will also need switches that support 802.1x


The problem is that TCP/IP doesn't identify what AD domain packets are from. To my knowledge there is no firewall on the market that would facilitate creating a rule that says "only allow traffic from sources that are members of the AD domain MYCORP.COM". The firewall would have to have credentials on the source domain and would have to query AD for each new IP address - this would be painfully slow.

What you CAN do is to identify the IP addresses or subnets of authorized users, create a group that contains these users, and create a rule that says "allow machines in this group to access my network". This isn't a trivial task unless you are conversant with TCP/IP and firewalls. My thought is that you should consider hiring a consultant.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.