Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

I don't know much about networking security other than keeping unused ports closed is good. This is what I'm trying to accomplish:

enter image description here

I need to be able to keep my server (the dotted line) with limited access to the Internet, but full access to the other devices on the network. I only want to have my home server connect to the net for updates (via apt-get) or for wget'ing some files sometimes. Is there a way to block the net off but let it by easily for software updates?

I'm going to be running an apache web server from the server, but it should only be available to other devices on my network. I don't want someone being able to connect to it through the net. How can I do this securely?

Basically I need a full web server accessible from my network but not from the internet (unless I specifically ask it to).

share|improve this question
    
Hm, what about changing the subject to 'How to deny internet access to a server port on a (NATed) LAN?' or something like that? Currently you have to read the whole question to get an idea what it is about. –  maxschlepzig Aug 27 '11 at 6:24

1 Answer 1

up vote 4 down vote accepted

I assume that your gateway device to the internet does NAT (network address translation), i.e. your home network uses for example a private network like 192.168.0.* and you dynamically get one IP from your ISP which is used by the gateway.

In that case someone on the internet only is able to access port 80 on your home network web-server, when you have explicitly configured a port forwarding of port 80 to the web-server on your gateway.

Besides checking the gateway configuration you can also check it from a system with a different IP. Get the current external IP of your gateway and try to access port 80 from the other IP. And/or use nmap on it.

Edit:

On the LAN, on a linux system you can lookup the configured IP addresses via:

$ ifconfig | grep -A1 encap
eth0      Link encap:Ethernet  HWaddr 01:02:de:ad:be:af
          inet addr:192.168.1.1  Bcast:192.168.1.255  Mask:255.255.255.0
--
lo        Link encap:Local Loopback  
          inet addr:127.0.0.1  Mask:255.0.0.0

In this example it is on the 192.168.1.* network, which is a private address range, i.e. one need a gateway that does NAT for internet access:

$ route -n
Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
192.168.1.0     0.0.0.0         255.255.255.0   U     1      0        0 eth0
0.0.0.0         192.168.1.42    0.0.0.0         UG    0      0        0 eth0

Meaning that the gateway has the IP 192.168.1.42 on the LAN.

Usually all this is automatically configured via DHCP - where e.g. the DHCP server runs on the gateway device.

To get the external IP address of the gateway one can use the administrative interface of it or browse an internet site that displays it, e.g.

$ curl -s http://www.lawrencegoetz.com/programs/ipinfo/ | grep -A1 'Your IP'
<h1>Your IP address is<BR>
    64.34.119.12

(don't know this service - via google you can find a lot of alternatives)

share|improve this answer
    
Wow, I actually didn't know that you only got 1 IP from your ISP. I thought every new device received one dynamically. I need to read... –  MaxMackie Aug 27 '11 at 14:04
1  
@MaxMackie, added a few notes about investigating the LAN. –  maxschlepzig Aug 27 '11 at 18:23

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.