This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Disable access to 2nd LAN?

For the past year, I've had a simple network with one LAN interface (office).

I'm adding another LAN (classroom) and don't want it to access the office LAN. I was able to configure my classroom LAN tonight and got the HTTP profile rules working, but the classroom LAN can access resources on the office network.

When I changed the packet rule for the Classroom network to "Classroom/Any/External", I couldn't access the Internet. If I change it to "Any", I can - but then I can also access a web server on the office network.

How should I change my rules to block the classroom from accessing the office LAN?

External (192.168.25.x)
Internal (192.168.0.x)
Classroom (192.168.1.x)

Packet filters
Internal (network)/Any/Any
Classroom (network)/Any/Any

Masquerading
Internal (network) -> External (WAN)
Classroom (network) -> External (WAN)

This thread was automatically locked due to age.

Parents

0 BarryG over 16 years ago

Add a new PacketFilter rule at the top,
Source Classroom, Dest Internal, Any, DROP

If you have webservers in Internal, you may need to also block them in the proxy.

Barry
Cancel
Vote Up 0 Vote Down

Cancel
0 krbc over 16 years ago in reply to BarryG

Thanks Barry! I knew it was probably an easy fix.

The webserver could be disabled. I was just using it as an easy test to see if the classroom network could access resources on the office LAN.
Cancel
Vote Up 0 Vote Down

Cancel
0 BAlfson over 16 years ago in reply to krbc

Great solution, Barry.

krbc, BarryG taught me another trick several months ago that solves your problem in a more-elegant way, with an interface rule...

First, define a network "Internet" on the External interface with address 0.0.0.0 and netmask /0.

Now, replace your packet filter rule with 'Classroom (Network) -> Internet : Any : Allow'.

Cheers - Bob
Cancel
Vote Up 0 Vote Down

Cancel
0 BarryG over 16 years ago in reply to BAlfson

Bob, that wasn't me, but it is a good way to do it as well.

Barry
Cancel
Vote Up 0 Vote Down

Cancel

Reply

0 BarryG over 16 years ago in reply to BAlfson

Bob, that wasn't me, but it is a good way to do it as well.

Barry
Cancel
Vote Up 0 Vote Down

Cancel

Children

0 BAlfson over 16 years ago in reply to BarryG

Well, Barry, maybe you were the one who explained why someone would want an interface rule. You've got so many good ideas that you can't even remember you've had some of them!

Cheers - Bob
Cancel
Vote Up 0 Vote Down

Cancel