Segmenting LAN addresses?

Armz
2011-05-31
2013-03-05
  • Armz

    Armz - 2011-05-31

    Hello.

    With 10 workstation/server machines connected to one switch, then to one router (192.168.55.1) before the Internet.

    Would it be of any benefit to divide the LAN addresses in the firewall and create 2 objects for the LAN
    1. LAN traffic only = 192.168.55.2 - 192.168.55.254
    2. Router traffic in/out = 192.168.55.1

    Instead of 192.168.55.0/24

    Thank you.
    Armz

     
  • Mike Horn

    Mike Horn - 2011-06-02

    I don't see any real benefit of segmenting the LAN addresses.  You can use the interface object to define traffic specific coming in/out of the firewall.  Is there some type of rule that you are trying to create that you can't by using only the network object?

     
  • Armz

    Armz - 2011-06-05

    Hello Mike.

    Thank you for your reply. I am sorry but the client decided on not using FWB.

    They were asking if  it  would be an increase in security if the LAN machines would deny traffic from the router 192.168.55.1 since they are all accessing the internet via a single firewall machine that allows internet access.
    Allowing 192.168.55.2 - 192.168.55.254 would give LAN inter communications but deny any router 192.168.55.1

    Thanks again.
    Armz

     

Get latest updates about Open Source Projects, Conferences and News.

Sign up for the SourceForge newsletter:





No, thanks