I don't know much about networking security other than keeping unused ports closed is good. This is what I'm trying to accomplish:

enter image description here

I need to be able to keep my server (the dotted line) with limited access to the Internet, but full access to the other devices on the network. I only want to have my home server connect to the net for updates (via apt-get) or for wget'ing some files sometimes. Is there a way to block the net off but let it by easily for software updates?

I'm going to be running an apache web server from the server, but it should only be available to other devices on my network. I don't want someone being able to connect to it through the net. How can I do this securely?

Basically I need a full web server accessible from my network but not from the internet (unless I specifically ask it to).

  • Hm, what about changing the subject to 'How to deny internet access to a server port on a (NATed) LAN?' or something like that? Currently you have to read the whole question to get an idea what it is about. – maxschlepzig Aug 27 '11 at 6:24

I assume that your gateway device to the internet does NAT (network address translation), i.e. your home network uses for example a private network like 192.168.0.* and you dynamically get one IP from your ISP which is used by the gateway.

In that case someone on the internet only is able to access port 80 on your home network web-server, when you have explicitly configured a port forwarding of port 80 to the web-server on your gateway.

Besides checking the gateway configuration you can also check it from a system with a different IP. Get the current external IP of your gateway and try to access port 80 from the other IP. And/or use nmap on it.


On the LAN, on a linux system you can lookup the configured IP addresses via:

$ ifconfig | grep -A1 encap
eth0      Link encap:Ethernet  HWaddr 01:02:de:ad:be:af
          inet addr:  Bcast:  Mask:
lo        Link encap:Local Loopback  
          inet addr:  Mask:

In this example it is on the 192.168.1.* network, which is a private address range, i.e. one need a gateway that does NAT for internet access:

$ route -n
Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface   U     1      0        0 eth0         UG    0      0        0 eth0

Meaning that the gateway has the IP on the LAN.

Usually all this is automatically configured via DHCP - where e.g. the DHCP server runs on the gateway device.

To get the external IP address of the gateway one can use the administrative interface of it or browse an internet site that displays it, e.g.

$ curl -s http://www.lawrencegoetz.com/programs/ipinfo/ | grep -A1 'Your IP'
<h1>Your IP address is<BR>

(don't know this service - via google you can find a lot of alternatives)

  • Wow, I actually didn't know that you only got 1 IP from your ISP. I thought every new device received one dynamically. I need to read... – n0pe Aug 27 '11 at 14:04
  • 1
    @MaxMackie, added a few notes about investigating the LAN. – maxschlepzig Aug 27 '11 at 18:23

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.