0

WannaCry infected other machines through the LAN. That made me think of how we use the LAN at our office: The traffic is client<->server, client<->internet, and server<->internet - never client<->client.

What would be an easy way block client<->client traffic? E.g. is it possible to make a 24-port switch regard the first 20 ports as client ports between which the traffic is blocked, and make the last 4 ports be regarded as server/internet ports which can talk to any other port?

  • how to configure a switch is off-topic here (not a security question), but blocking client-to-client traffic could be a on-topic question - are you open to non-switch-related options? – schroeder May 22 '17 at 10:52
1

Some switches support the private VLANs concept, which does exactly what you describe. It's not really common on low end devices though. The alternative (which may be a bit more flexible) is to use local firewalls (which is a good idea anyway) and allow only traffic to and from specific hosts and ports.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.