Take the 2-minute tour ×
Ask Ubuntu is a question and answer site for Ubuntu users and developers. It's 100% free, no registration required.

There are a lot clients inside a LAN. The server is trusted, the clients are not.

It has to be ensured that other clients can not spoof another clients or the servers LAN IP address.

I want to prevent to bothering with something like openvpn or ipsec, because encryption is not required (LAN) and those solutions are overkill and complicated to learn.

Are there any simple alternatives?

share|improve this question
add comment

2 Answers

up vote 1 down vote accepted

Due to the basic design of Ethernet you can not protect clients in the same broadcast domain from spoofing each other. Even though the switch that they are connected to will learn MAC address to port mappings and try to only send traffic to the correct port, there are tricks that can be pulled to spoof another station's MAC address and get their traffic. Look up tools like Ettercap.

Therefore, you need to build your security model around segregating things that absolutely must not spoof each other into different VLANs. So for example you might put everything that only has admin access in one or more VLANs and put everything that has untrusted users into one or more other VLANs.

Inside each VLAN, traffic that absolutely must not be impersonated/sniffed by other stations in the same VLAN must use encryption at the transport layer.

share|improve this answer
add comment

The easy alternative would be to place a firewall of some sort between the client and server LAN segments. Then you would want to configure the firewall with options around packet spoofing and such. I would configure and harden a version of Ubuntu server with IPTABLES enabled that sits between the clients and servers. I would configure the IPTABLES rules on an Ubuntu desktop using Firewall builder and then deploy the ruleset to the firewall server. That would be the cheap version. If you have some cash on hand I would order, install, and configure a hardware firewall such as Cisco ASA or a Checkpoint.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.