1

I am thinking about using a raspberry pi, or some other SBC, to open a simple node.js based web server and a ssh server. I know that when opening ports there are always security vulnerabilities created. While I don't care too much about people getting into my SBC I was wondering if opening a port would also make other computers on the same network insecure.

If so, is there a way to 'isolate' the SBC from the other computers on my network?

  • I assume you're opening a port on a router, or other NAT device, not the Pi. Basically, your question does not really make sense from a network point of view: opening a post normally means pushing traffic from one network onto another. – grochmal Oct 2 '16 at 0:12
2

Whenever you open up a port for inbound traffic, you are adding some risk to the network. Note that you said "insecure" but the truth is that you need to think about levels of risk. There is no such thing as a "Secure" computer, especially one connected to the Internet. You simply need to make breaking into it too hard to be bothered with. You should also try to limit the damage someone can do if they do break in which is really what you are asking when you talk about "isolation".

The risk is obviously greatly multiplied if you allow an attacker to gain a foothold on any computer, even an SBA. This is particularly true of a home network where you typically have no segmentation of the LAN. So you should and MUST care about the SBA in that situation. Thankfully, most SBA's run pretty standard Linux installations and so can be configured with the same level of security as something like a VPS.

Can you do anything?

Maybe. It rather depends on what equipment you have available or what you are prepared to install and configure. An increasing number of home/small-office routers are capable of creating a DMZ which isolates one or more machines on their own network segment. Alternatively, you can create a really strong DMZ by chaining 2 routers with your inner router carrying your WiFi and other computers and the external one connected not only to the inner router but also to your semi-protected SBA.

Also make sure that any user accounts on the Pi have no relation to user accounts on any other device and that the Pi does not need to connect to anything on your inner network. If you need comms to the Pi - which surely you will - they should be "pushed" to the Pi and not from the Pi to another device.

| improve this answer | |
1

You are right: the other computers are at risk.

Solution: use a Firewall and put the Raspberry Pi in the DMZ. This will isolate your Raspberry Pi from the other PCs.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.