I have two network segments (call them A @ 192.168.1.x and B @ 192.168.2.x) plugged into two separate NICs (NIC-A and NIC-B).

The OS on the physical machine is standard stock Ubuntu, with nothing configured to do any bridging on routing. So it can "see" both networks, but the two networks don't have a way to talk to each other.

Devices on Network-B don't have a default gateway assigned.

Network B has no internet access, and I want to make sure that it stays segregated.

Is this sufficient to consider this solution fairly secure? Or should we consider implementing something on the OS to actually firewall these two networks?

  • 7
    as always, the question is "secure from what?" – schroeder Nov 7 '17 at 22:14

That has certainly segregated the data and should be reasonably secure as long as nothing creates a route between the networks later on. That is not always easy to control when using a general purpose computer and OS. It would be more secure to implement the network using dedicated hardware designed for the purpose.

As you haven't specified the level of sensitivity nor the reason for wanting segregation between the networks, I don't think it is possible to say more.

  • 1
    Anonymous downvoter? Please add comments when downvoting so that people can improve answers. – Julian Knight Mar 13 at 12:54

In your setup, in order to have a packet going from one network to the other, the kernel must be instructed to do so (see /proc/sys/net/ipv4/ip_forward for the current status).

You rely on this flag not being in place. While today you may set it to not forward, something can happen tomorrow which will change this and your networks will become interconnected (it is enough for a script to temporarily enable forwarding for instance)

It is therefore better to be explicit, through a firewall configuration. In that case you will need, a way or another, to change the configuration of the firewall - which is less likely to be done by mistake.

As for the "implementing something on the OS" part, I would suggest FireHOL which ultimately creates iptables rules, but in a more descriptive way (and therefore probably more secure as you are less likely to make a mistake, especially at the beginning). My previous choice for years has been shorewall but it became too complicated (though it is a very capable solution).

Your Answer

 

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.