Page 1 of 2 12 LastLast
Results 1 to 10 of 14

Thread: Should I permanently allow 2 LAN computers access each other via both firewalls?

  1. #1
    Join Date
    Feb 2008
    Location
    Munster, Ireland
    Beans
    2,270
    Distro
    Xubuntu

    Question Should I permanently allow 2 LAN computers access each other via both firewalls?

    Hi.

    I sync my main PC to my secondary PC often. I temporarily disable firewalls on both computers and re-enable UFW when I'm finished. I sync via an Ethernet cable and am not on the Internet when syncing.

    Instead of disabling the 2 PC firewalls all the time. Would it be best in permanently allowing both private IP address or permanently allow ssh? Would this be a security risk when I go online? I also have a firewall on my router.

    PC #1 = 192.168.1.5
    PC #2 = 192.168.1.6

    I sync all data to PC#2 using Grsync and any files not on PC#1 are deleted on PC#2.

    Thanks.
    1st Distro used (live CD): Knoppix in early 2007 ¦ 1st Distro Installed: Ubuntu 7.10 in Feb 2008
    GNU/Linux User #470660 – Ubuntu User #28226
    Isaac Asimov: "I do not fear computers. I fear the lack of them."

  2. #2
    Join Date
    May 2010
    Location
    Tewkesbury uk
    Beans
    7,625
    Distro
    Ubuntu Development Release

    Re: Should I permanently allow 2 LAN computers access each other via both firewalls?

    Hi

    You could set a static IP address on each computer and punch a hole in both firewalls for the IP address/MAC address/port combination for each computer.

    Allow incoming new,established and outgoing established connections only from these IP/MAC/port combinations.

    As you have a firewall on your router, i think this would help mitigate any security risks it would entail.

    I'd be interested in the opinion of others.

    Kind regards
    Last edited by matt_symes; May 10th, 2014 at 08:23 PM. Reason: Must be going blind
    Join us on irc at #ubuntuforums. For web chat see here

    If you believe everything you read, you better not read. ~ Japanese Proverb

    Do not read newspapers on an empty stomach ~ Russian Proverb ~ BrunoLotse

  3. #3
    Join Date
    Sep 2006
    Beans
    7,227
    Distro
    Lubuntu Development Release

    Re: Should I permanently allow 2 LAN computers access each other via both firewalls?

    If the ip addresses are permanent, you could allow only incoming from the other machine:

    Code:
    sudo ufw allow proto tcp from 192.168.1.5 to any port ssh
    I think that might be near or at the limit of UFW. If you want to do rate limiting plus restricting to a specific IP you might need to work with iptables directly.

    Can grsync use SSH keys like rsync can?

  4. #4
    Join Date
    Feb 2008
    Location
    Munster, Ireland
    Beans
    2,270
    Distro
    Xubuntu

    Re: Should I permanently allow 2 LAN computers access each other via both firewalls?

    I've got static addresses that I connect to. When I'm on the Internet, I'm only on the Wi-Fi connection.
    Attached Images Attached Images
    1st Distro used (live CD): Knoppix in early 2007 ¦ 1st Distro Installed: Ubuntu 7.10 in Feb 2008
    GNU/Linux User #470660 – Ubuntu User #28226
    Isaac Asimov: "I do not fear computers. I fear the lack of them."

  5. #5
    Join Date
    Sep 2006
    Beans
    7,227
    Distro
    Lubuntu Development Release

    Re: Should I permanently allow 2 LAN computers access each other via both firewalls?

    Is your LAN on eth0 and your Wi-Fi on eth1? If the LAN connection is on a different interface than your Wi-fi then you can write the iptables rules to allow just SSH, just from the fixed IP address, and just on that one interface.

  6. #6
    Join Date
    Feb 2008
    Location
    Munster, Ireland
    Beans
    2,270
    Distro
    Xubuntu

    Re: Should I permanently allow 2 LAN computers access each other via both firewalls?

    My NM Static connection is eth0 and Wi-Fi connection is wlan0.
    1st Distro used (live CD): Knoppix in early 2007 ¦ 1st Distro Installed: Ubuntu 7.10 in Feb 2008
    GNU/Linux User #470660 – Ubuntu User #28226
    Isaac Asimov: "I do not fear computers. I fear the lack of them."

  7. #7
    Join Date
    Sep 2006
    Beans
    7,227
    Distro
    Lubuntu Development Release

    ufw

    Then your UFW modification could be done something like this:

    Code:
    sudo ufw allow in on eth0 proto tcp from 192.168.1.5 to 192.168.1.6 port ssh
    That would be done on .6 and the opposite would be done on .5

  8. #8
    Join Date
    Feb 2008
    Location
    Munster, Ireland
    Beans
    2,270
    Distro
    Xubuntu

    Re: ufw

    Quote Originally Posted by Lars Noodén View Post
    ...
    Code:
    sudo ufw allow in on eth0 proto tcp from 192.168.1.5 to 192.168.1.6 port ssh
    ...
    Thank you Lars.

    Your solution works perfectly.

    That would be no security problem when I'm online? I don't use the LAN cable when I'm using WiFi.
    1st Distro used (live CD): Knoppix in early 2007 ¦ 1st Distro Installed: Ubuntu 7.10 in Feb 2008
    GNU/Linux User #470660 – Ubuntu User #28226
    Isaac Asimov: "I do not fear computers. I fear the lack of them."

  9. #9
    Join Date
    Sep 2006
    Beans
    7,227
    Distro
    Lubuntu Development Release

    Re: Should I permanently allow 2 LAN computers access each other via both firewalls?

    It should be no problem because the rules for eth0 apply only to that interface and the wifi uses only wlan0. You can list the rules you have with iptables-save or ufw and go through them to be sure.

    Code:
    sudo ufw status verbose

  10. #10
    Join Date
    Feb 2008
    Location
    Munster, Ireland
    Beans
    2,270
    Distro
    Xubuntu

    Re: Should I permanently allow 2 LAN computers access each other via both firewalls?

    Quote Originally Posted by Lars Noodén View Post
    It should be no problem because the rules for eth0 apply only to that interface and the wifi uses only wlan0. You can list the rules you have with iptables-save or ufw and go through them to be sure.

    Code:
    sudo ufw status verbose
    Cheers Lars.

    Quote Originally Posted by Lars Noodén View Post
    Is your LAN on eth0 and your Wi-Fi on eth1? If the LAN connection is on a different interface than your Wi-fi then you can write the iptables rules to allow just SSH, just from the fixed IP address, and just on that one interface.
    Was that a typo about "Wi-Fi on eth1"?
    1st Distro used (live CD): Knoppix in early 2007 ¦ 1st Distro Installed: Ubuntu 7.10 in Feb 2008
    GNU/Linux User #470660 – Ubuntu User #28226
    Isaac Asimov: "I do not fear computers. I fear the lack of them."

Page 1 of 2 12 LastLast

Bookmarks

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •