Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.
Sign up to join this community
WannaCry infected other machines through the LAN. That made me think of how we use the LAN at our office: The traffic is client<->server, client<->internet, and server<->internet - never client<->client.
What would be an easy way block client<->client traffic? E.g. is it possible to make a 24-port switch regard the first 20 ports as client ports between which the traffic is blocked, and make the last 4 ports be regarded as server/internet ports which can talk to any other port?
Some switches support the private VLANs concept, which does exactly what you describe. It's not really common on low end devices though. The alternative (which may be a bit more flexible) is to use local firewalls (which is a good idea anyway) and allow only traffic to and from specific hosts and ports.
