I have the following setup:

Net1 -> Router-net1 (w/firewall) -> Net2 -> firewall -> Internet

In Net1 I have several machines I use to run experiments. I would like to minimise the risk of unauthorised access to Net1´s machines, while allowing authorised users to access the machines in Net1 from Net2.

Right now, I have the following security measures in place:

  • I configured NAT and port forwarding on Router-net1, so that I can ssh to the router´s IP to get access to one of the machines in Net1. I.e. only port 22 is open on the router 22 on the Net2 side (from inside Net1, port 80 is also open to access the management console)
  • No possible to ping the router

I wonder how secure, in overall terms, the current setup is to prevent unauthorised access. I also have the following more specific questions:

  • Would it be more secure if I setup a VPN server on Net1?
  • Would it be more secure if I place a second firewall (a Linux machine with two ethernet ports) between Net1 and Router-net1? Does it make any sense?
  • Currently router-net1 acts also as DHCP server for Net1. Should I disable this?
  • Should I disable PING and other protocols within Net1?

closed as too broad by Stephane, Steve, schroeder Apr 3 '17 at 14:54

Please edit the question to limit it to a specific problem with enough detail to identify an adequate answer. Avoid asking multiple distinct questions at once. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.

  • block all Internet addresses from initiating connections on router-net1 seems the obvious choice – schroeder Apr 3 '17 at 12:34
  • That question is unanswerable: it is way too broad as well as unclear (because you don't define at all what you want to secure except a vague subnetwork range) – Stephane Apr 3 '17 at 12:36
  • Agreed with Stephane, this is a very broad question. Don't take it wrong, but what you need is a network consultant, not a stackexchange post. – Ricardo Reimao Apr 3 '17 at 12:48
  • @Stephane I agree the question is too broad. I have tried to make it more specific now. I guess I am just trying to understand right now how secure the current solution is in overall terms and what measures could I put into place to improve it. Thanks – nicolas Apr 3 '17 at 14:00
  • @nicolas The thing you should do is a threat analysis. You need to identify the assets you want to protect and assign them values. Based on that, you do a risk analysis where you list the risks to these assets, the likelyhood associated with these risks. Then you can start wondering what you can do to improve your security: list possible solutions for each risk and the potential fixes you can deploy (along with a price tag) – Stephane Apr 3 '17 at 14:50