1

So in general I am a home user who is Tech Savy and played a lot with home networking equipment and want to completely secure my network and make it tight and harder to hack than standard home network even though when user done something stupid or got tricked for example to install malware or a reverse shell which for example could have been executed from a PDF file or Microsoft Office Suite like Word etc.

I have recently saw this type of a corporate network and think it is very secure:

(VLAN's with Private IP -> 10.0.X.X) ---> (Proxy/Different Servers) --> <--- (Internet)

It will be hard to explain as the network is kind of complex but here it goes:

The computers in such network have shared network resources which are File Shares as well as printers available to use and each computer have a private local IP address but can't touch each other and it's not possible or more like hard to even infect it. However, when the website is pinged, it only receives a DNS address back through hopping a different internal addresses (10.0.X.X) which I presume are the different machines in the local network setup with DNS Server and NAT to access outside world (?) but packets itself don't reach internet directly from a computer which tried to pinged a website.

Now, when such computer with a local IP address and no internet access at all wants to access outside world, it goes through Proxy/Server which caches content for all the local computers and passes it back to them. Now when the Reverse Shell or in fact any type of virus/malware which needs to call home is executed it cannot spread across the network or even connect back to the C&C server (Command and Control Server) as there is no internet on such computers except the Proxy/Server which caches web content and pushes it back to a local network.

Is it possible to setup similar type of network in home environment or should I just let it go as it might be a bit complex ? I mean, I'm always happy to learn something new.

Also I heard about ClearOS and asked them the same question but it seems that this type of network is not possible to set it up in this software.

1

You can implement such type of setup by using squid as proxy server inside your network, and give it access to the internet on your home router and deny all other computers from the internet access.

But such setup will depend on which type of home router you have, your home router should have some kind of firewall configuration or you will use Linux box as a gateway with IPtables.

I want to add also that such configuration will mitigate the risk of some remote access threats only and many advanced threats are smart enough to pass such scenarios.

  • So from your perspective, how would you setup such network to eliminate those remote risks ? – DarryTheGutten Feb 26 '17 at 9:19

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.