0

WannaCry infected other machines through the LAN. That made me think of how we use the LAN at our office: The traffic is client<->server, client<->internet, and server<->internet - never client<->client.

What would be an easy way block client<->client traffic? E.g. is it possible to make a 24-port switch regard the first 20 ports as client ports between which the traffic is blocked, and make the last 4 ports be regarded as server/internet ports which can talk to any other port?

1
  • how to configure a switch is off-topic here (not a security question), but blocking client-to-client traffic could be a on-topic question - are you open to non-switch-related options?
    – schroeder
    May 22, 2017 at 10:52

1 Answer 1

1

Some switches support the private VLANs concept, which does exactly what you describe. It's not really common on low end devices though. The alternative (which may be a bit more flexible) is to use local firewalls (which is a good idea anyway) and allow only traffic to and from specific hosts and ports.

1

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .