1

I am not really sure how this is possible but I have a linux(ubuntu 14.04) box with 2 interfaces. eth0 is connected to our lan 192.168.0.* and eth1 is connected to a dlink wifi router on network 192.168.3.* .

Wifi network is only available for mobile devices. They are only supposed to access a web application installed on the box. I want to prevent any eventualities such as accessing 192.168.0.* network even if someone gets authorized access to the box via ssh.

Is something like that possible?

EDIT

In /etc/sysctl.conf I have now net.ipv4.ip_forward=0 with sudo -p /etc/sysctl.conf with a restart of the machine. But it didn't work. I can ping 192.168.0.* network

#sysctl -a
net.ipv4.conf.all.accept_local = 0
net.ipv4.conf.all.accept_redirects = 1
net.ipv4.conf.all.accept_source_route = 0
net.ipv4.conf.all.arp_accept = 0
net.ipv4.conf.all.arp_announce = 0
net.ipv4.conf.all.arp_filter = 0
net.ipv4.conf.all.arp_ignore = 0
net.ipv4.conf.all.arp_notify = 0
net.ipv4.conf.all.bootp_relay = 0
net.ipv4.conf.all.disable_policy = 0
net.ipv4.conf.all.disable_xfrm = 0
net.ipv4.conf.all.force_igmp_version = 0
net.ipv4.conf.all.forwarding = 0
net.ipv4.conf.all.igmpv2_unsolicited_report_interval = 10000
net.ipv4.conf.all.igmpv3_unsolicited_report_interval = 1000
net.ipv4.conf.all.log_martians = 0
net.ipv4.conf.all.mc_forwarding = 0
net.ipv4.conf.all.medium_id = 0
net.ipv4.conf.all.promote_secondaries = 0
net.ipv4.conf.all.proxy_arp = 0
net.ipv4.conf.all.proxy_arp_pvlan = 0
net.ipv4.conf.all.route_localnet = 0
net.ipv4.conf.all.rp_filter = 1
net.ipv4.conf.all.secure_redirects = 1
net.ipv4.conf.all.send_redirects = 1
net.ipv4.conf.all.shared_media = 1
net.ipv4.conf.all.src_valid_mark = 0
net.ipv4.conf.all.tag = 0

EDIT 2

below is my iptables

Chain INPUT (policy ACCEPT)
target     prot opt source               destination         

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination         

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination  
  • 1
    Just turn off ip_forward, so traffic from two networks can not reach others. – cuonglm Aug 28 '14 at 11:35
  • thanks for your comments. /etc/sysctl.conf that is right? is it safer as opposed to iptables? search about turning off ip_forward led me to this post ubuntuforums.org/showthread.php?t=2087828 – black sensei Aug 28 '14 at 12:05
  • It depends on your purpose, if your server was not used as a router, turn off ip_forward is enough and simple. – cuonglm Aug 28 '14 at 12:09
  • I updated my answer. And it's not a router. – black sensei Aug 28 '14 at 12:29
  • 1
    If someone gets ssh access to the box which is connected to both networks, you can't stop them from talking to all networks that box is on. – Patrick Aug 28 '14 at 13:06
1

Setting net.ipv4.ip_forward to zero should prevent access your LAN network from any device behind the eth1. But you can't prevent anyone who accessed your box, if he has root access. Use iptables filter table and input or output chain to prevent non-root users who accessed the box from accessing you lan.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.