Solved Blocking a LAN ip from internet access/

[antares]

Hi all, I'm venturing into networking for the first time as I bought a Synology DS1813+ to manage backups/file storage, etc. This is my configuration:
- A Cisco ADSL Modem, connected to...
- A TP-LINK TL-R600VPN Gigabit Broadband VPN Router, connected to...
- TRENDnet 8-Port Unmanaged Gigabit GREENnet Standard Switch (8 x 10/100/1000Mbps) Model: TEG-S80G

The switch is connected to two devices:

- My PC's Intel LAN Gigabit Port (it also has another Realtek unused Gigabit LAN port) and Synology DS1813+ NAS.

Using auto configuration everything is working fine. However, I plan to assign a fixed IP address for both my PC and the NAS.

What would be the most secure way of manually blocking the NAS from incoming/outgoing internet access? I know how to enter the router's interface, but have no idea how to block the NAS.
If I instead connect the NAS to the PC using its Realtek LAN port (the unused one), would that isolate the NAS from the internet?

Thanks

 

[tomerello]

I have never used this NAS before but if you don't assign the device a standard gateway would it not be able to connect to the big mysterious internet.

 

[Shadowjk]

Personally, I would set a static IP address to the NAS and then apply and access control list on the router. To do so please follow your routers manual below (Page 38 onwards). This should allow clients connected directly to the router access to the NAS however you may find that only hosts connected to the switch will have access.

http://www.tp-link.com/Resources/document/TL-R600VPN_V1_User_Guide.pdf

Remember to set the static IP address stack outside your DHCP scope otherwise you may encounter IP address conflicts (Page 26 to find ranges)

EDIT: @Tomerello, sure would but could have complications with VPN since the router is the middle man.

Both viable options though.

Hope This Helps,
Josh

 

[antares]

Thanks tomerello and Josh for your answers.
Josh, I will research those router manual pages to follow your suggested path and will update this post.
What about the other option I mentioned? I mean, if I disconnect the NAS from the switch and instead connect it directly to the other PC's unused LAN port (Realtek). Would that guarantee the NAS being isolated from the internet?

 

[Shadowjk]

Yes it would stop the NAS accessing the internet but it would also stop anyone else but the machine connected to it being able to access since the NAS will have to be on a different subnet.

Josh

 

[antares]

Yes it would stop the NAS accessing the internet but it would also stop anyone else but the machine connected to it being able to access since the NAS will have to be on a different subnet.

Josh

The Subnet Mask currently used by the LAN's router is 255.255.255.0 . If, as mentioned earlier, I try a direct NAS to PC connection (to the unused Realtek LAN port) overriding the switch, what Subnet Mask should I use when configuring such direct connection? I guess it should be a number different from 255.255.255.0 as that is the one used by the router?

Also, if I set a static IP for both the NAS and PC, can I connect them via the Switch alone without the router? The only benefit over the direct LAN-PC connection would be the possibility of adding more devices to the internet-less LAN?

 

[Shadowjk]

If, as mentioned earlier, I try a direct NAS to PC connection (to the unused Realtek LAN port) overriding the switch, what Subnet Mask should I use when configuring such direct connection? I guess it should be a number different from 255.255.255.0 as that is the one used by the router?

The subnet mask can be the same if you wish and for easy configuration I would keep it the same for the Realtek port. When I mean a different subnet I mean a slightly different IP address. For example your IP address for the network card connected to the switch could be '192.168.1.X'. The penultimate number/octet represents the network based on the subnet mask. Therefore for the realtek port that would connect to the NAS you would have an IP address of something like '192.168.2.X' Since 2 is different than 1. By doing so you have created a new network. Keep the subnet mask the same 255.255.255.0 for all LAN cards when setting up static IP addresses and the default gateway is the IP address of your router. For the realtek port you won't have a router therefore you can leave that blank. When setting a static IP address for your network card that is connected to the switch make sure that the DNS servers are set to the same IP address as your default gateway.

Also, if I set a static IP for both the NAS and PC, can I connect them via the Switch alone without the router?

Yes, For example if your PC has an IP address of 192.168.1.10 and your router has an IP address of 192.168.1.1, you can just simply set a static IP address on your NAS by changing the last octet/set of numbers. For example you could set the IP address for the NAS as 192.168.1.50 with a subnet mask of 255.255.255.0. By doing so, whenever you wish to connect to your NAS you can do so without going through your router .

The only benefit over the direct LAN-PC connection would be the possibility of adding more devices to the internet-less LAN?

That would be correct but the major disadvantage or advantage depending on how you look at it, is that only the PC directly connected would have access to the NAS. Any other machine connected to the switch or wireless network would not have access to the NAS.

Hopefully this answers some of your questions,
Josh

 

[antares]

Hi Shadow again, you seem to be a knowledgeable networking guy, can you recommend a book in TCP/IP networking for newbies like me? Thanks

 

[Shadowjk]

Hi Shadow again, you seem to be a knowledgeable networking guy, can you recommend a book in TCP/IP networking for newbies like me? Thanks

It depends really what sort of area in networking you want to look into. For example I'm better with network infrastructure than with file sharing and homegroups. As for a book, I don't know one that I could recommend unfortunately I did however find a microsoft page on TCP/IP which you may wish to look into. It does get quite complex with binary but overall it tells you the fundamentals of IPv4

http://support.microsoft.com/kb/164015

Hope this helps,
Josh

 

[antares]

Thanks Josh, nice link. This is considered to be a classic for TCP/IP, even though it's quite old, but still relevant. Regards.

 

[Shadowjk]

Nice book once you understand the basics of TCP/IP everything that uses it becomes easier to understand. Especially when getting into how routers work and how they decide which path is the best.

Josh

 

[antares]

Hi Josh, I think I successfully blocked my NAS from internet access by using the Internet Access Control feature of my router as you suggested. This is what I did:

- Logged into the router's (TL-R600VPN) web configuration page
- Went to "Access Control"
- Clicked on "Add New"
- "Rule Name"="NAS_Block"
- "Click here to aadd new host list"
- "Mode"="IP Address"
- "Host Description"="NAS"
- LAN IP Address"="192.168.0.99" (static IP assigned outside DHCP scope)
- "Save"
-"Host":"NAS"
-"Target"="Any Target"
-"Schedule"="Anytime"
-"Action"="Deny"
-"Status"="Enabled"
-"Save"

Once this rule was created as above I ticked "Enable Internet Access Control" and " Allow the packets not specified by any access control policy to pass through the Router", then click "Save"

I then tested a simple internet access operation from my NAS like time synchronization and it was unable as access to the net was blocked.

So is this the most secure way of protecting the NAs from the Internet (as secure as physically unplugging the cable), or could someone hack the router, change its configuration and gain access to any LAN's host (including the NAS)?

 

[Shadowjk]

Nice, I'm glad you managed to work it out

It is going to be as secure as you're going to get. Your router should not accept requests to access it's settings from the outside and plus a hacker will have to try and evade your ISPs security infrastructure before reaching you so you are pretty secure from that standpoint.

The only way a hacker could easily gain entry is by your machine. Therefore make sure that you have a good anti-virus application so that any malware that could try and gain entry to the network is negated. Apart from that most entry points are secure

Of course please be advised that anyone who connects to the switch will have access to the NAS so you may want to look as to how physically secure your switch is. To be honest if it's in your house I would be more concerned about them breaking in the house rather than trying to access your NAS

Hope this helps,
Josh

 

[antares]

Of course please be advised that anyone who connects to the switch will have access to the NAS so you may want to look as to how physically secure your switch is.

But regarding my local LAN, I can configure folder permissions within DSM (The NAS OS) so that a given user can access a given NAS folder and not others, I guess that would take care of the local LAN NAS security regardless of anyone gaining physical access to the switch, right?

 

[Shadowjk]

Correct, though if someone still gets physical access they will be able to communicate with your machine and any other device on your network but the NAS. They would also be able to access your router settings if they are connected by the switch however I am assuming you have an appropriate username and password to try and circumvent that.

Josh

 

[antares]

Correct, though if someone still gets physical access they will be able to communicate with your machine and any other device on your network but the NAS. They would also be able to access your router settings if they are connected by the switch however I am assuming you have an appropriate username and password to try and circumvent that.

Josh

Josh, the router settings are protected by a username and password, and also I set a filter by which only the MAC address of my PC can access it.
regarding other hosts in the LAN, a newcomer connected to the switch won't be able to access other LAN devices or the internet if they are also protected by appropriate permission rules either locally or through the router.
Well, as you said earlier, I think I have to worry more about someone intruding my home and stealing.