Restrict SSH access within subnet



  • Hi Guys

    Is this possible? To restrict SSH access where Source and Desti IPs are in the same subnet and interface?

    Thanks
    Jao


  • Netgate

    Not with your Layer 3 firewall since the traffic isn't routed but is on the LAN directly between nodes. You might be able to do it with a decent switch and switch port ACLs.

    eg.

    ip access-list extended "Block SSH"
    deny tcp any any eq ssh
    permit ip any any

    interface ethernet 1/1/4
    ip access-group "Block SSH" in



  • Hi Derelict

    I'm using pfsense 2.1.5 as firewall

    ip access-list extended "Block SSH"
    deny tcp any any eq ssh
    permit ip any any

    interface ethernet 1/1/4
    ip access-group "Block SSH" in

    Are this pfsense option/command?

    What I'm trying to say is I have LAN interface and both my servers and clients are in the same interface (LAN) and segment (192.168.0.x). I try to create a rule where clients (192.168.0.150) are not allowed to ssh to my server (192.168.0.9) except me (92.168.0.55).  See attached file

    Thanks!



  • Netgate

    No You can't filter traffic between subnet hosts with a firewall/router like pfSense because same-subnet traffic isn't routed.

    Your LAN host 192.168.0.150 will not send traffic destined for 192.168.0.9 to pfSense, so those rules will do you no good. It will, instead, ARP on LAN for the MAC address of 192.168.0.9 and send the traffic directly to the destination host. pfSense will not be involved at all. That's how same-subnet traffic works.

    Those commands show you how to do it in a decent switch. That is for a Brocade ICX if host 192.168.0.150 was plugged into switch port 1/1/4.



  • ow I see, so to make this work I need to have separate interface  for my Server and my client to filter SSH access and other traffic? Is that right?

    Thanks!


  • Netgate

    Yes. If you want your router to be able to filter such traffic the server and host need to be on separate router interfaces.



  • Ok got it Derelict

    Thanks a lot!

    1 Thank/s for you :)


  • Rebel Alliance Global Moderator

    I think your missing the point.. If you want to block client A from going to B that are all in the same network 192.168.1.0/24 for example..  Pfsense would have nothing to do with this traffic… You would have to route the traffic using pfsense as the router if you wanted it to firewall that traffic.  So A would have to be in say 192.168.1.0/24 and B would have to be in 192.168.2.0/24 where pfsense is the router between those segments.



  • You can do it via ssh_config:

    AllowUsers jao@172.16.1.2
    
    AllowUsers kom@192.168.1.*