I have the following setup:
Net1 -> Router-net1 (w/firewall) -> Net2 -> firewall -> Internet
In Net1 I have several machines I use to run experiments. I would like to minimise the risk of unauthorised access to Net1´s machines, while allowing authorised users to access the machines in Net1 from Net2.
Right now, I have the following security measures in place:
- I configured NAT and port forwarding on Router-net1, so that I can ssh to the router´s IP to get access to one of the machines in Net1. I.e. only port 22 is open on the router 22 on the Net2 side (from inside Net1, port 80 is also open to access the management console)
- No possible to ping the router
I wonder how secure, in overall terms, the current setup is to prevent unauthorised access. I also have the following more specific questions:
- Would it be more secure if I setup a VPN server on Net1?
- Would it be more secure if I place a second firewall (a Linux machine with two ethernet ports) between Net1 and Router-net1? Does it make any sense?
- Currently router-net1 acts also as DHCP server for Net1. Should I disable this?
- Should I disable PING and other protocols within Net1?