3

Isolate clients on same subnet?

view full story
linux-howto

http://serverfault.com – Given n (e.g. 200) clients in a /24 subnet and the following network structure: client 1 \ . \ . switch -- firewall . / client n / (in words: all clients connected to one switch and the switch connected to the firewall) Now by default, e.g. client 1 and client n can communicate directly using the switch, without any packets ever arriving the firewall. Therefore none of those packets could be filtered. However I would like to filter the packets between the clients, therefore I want to disallow any direct communication between the clients. I know this is possible (HowTos)

grtyyu's picture
Submitted by grtyyu on 06/03/2012 – Made popular on 06/03/2012

Stories similar to Isolate clients on same subnet?

I have an OpenVPN server and many clients connecting.

I have an OpenVPN server and many clients connecting.

Say you have four Cisco 1142N's... and they're known as AP1, AP2, AP3, AP4. They all share the same SSID/encryption settings.

Clients can connect to any of the four and associate just fine, if you move physically so that the client device picks up another AP, that works fine also...

So, going from AP1 -> AP2 - no issue.

However, if you go from AP1 -> AP2 -> AP3 ...

If I have a network like:

Group1 -> Switch -> Switch -> Server (configured as gateway by DHCP) Group2 -> Switch -----^

(Hope that makes sense...)

When computers in each group send packets to other computers in the same group (so same switch), will the packets go all the way through the second switch to the server and back again or will they go directly to each other via the first s

My home-network is somewhat complex. I have a cable-modem which via a switch is connected to my router/firewall for serving internet to my actual LAN, but the same switch also connects via powerlan several set-top-boxes to the same cable-modem.

I asked this question on StackOverflow and was directed over here, so I'd appreciate any advice.

I'm deploying a smartphone application as part of a live music performance that depends on receiving UDP broadcast packets from a wireless access point. I'm guessing that between 20 and 50 clients will be connected at any one time.

I want to direct connect my server to two clients using 10 GBE.

I plan to use the ATTO FastFrame NT12 NIC.

http://www.attotech.com/products/product.php?cat=14&scat=34&prod=111&sku...

Now, few question as i'm new to the 10GBE:

can i assign a static IP C class address to each port on the card that is on the server (total of 2 ports=2 IP address)? Can i assign a static IP

Some background: We are about to move a customer's server to our facilities, but as that server is a DC, I see some issues with that.

The two sites will be connected with a VPN tunnel. The server will get an IP in the 10.0.0.0/30 (or something similar) subnet, while the clients are in a 192.168.100.X/24 subnet (will be changed from 192.168.1.X/24)

Anything I should think about?

I have managed to get iodine working between my ubuntu intrepid box and my windows client with a caveat.

The firewall rules allows DNS queries inbound. The client tunnel endpoint gets assigned an IP address and the tunnel is established properly.

However when I try to ping from the client machine, the reply packets are not coming back.

I used TCPDUMP on the Ubunto box and watch the dns0 tunnel