Restrict SSH access within subnet

[jao]

Hi Guys

Is this possible? To restrict SSH access where Source and Desti IPs are in the same subnet and interface?

Thanks
Jao

[Derelict]

Not with your Layer 3 firewall since the traffic isn't routed but is on the LAN directly between nodes. You might be able to do it with a decent switch and switch port ACLs.

eg.

ip access-list extended "Block SSH"
deny tcp any any eq ssh
permit ip any any

interface ethernet 1/1/4
ip access-group "Block SSH" in

[jao]

Hi Derelict

I'm using pfsense 2.1.5 as firewall

ip access-list extended "Block SSH"
deny tcp any any eq ssh
permit ip any any

interface ethernet 1/1/4
ip access-group "Block SSH" in

Are this pfsense option/command?

What I'm trying to say is I have LAN interface and both my servers and clients are in the same interface (LAN) and segment (192.168.0.x). I try to create a rule where clients (192.168.0.150) are not allowed to ssh to my server (192.168.0.9) except me (92.168.0.55).  See attached file

Thanks!

[Derelict]

No You can't filter traffic between subnet hosts with a firewall/router like pfSense because same-subnet traffic isn't routed.

Your LAN host 192.168.0.150 will not send traffic destined for 192.168.0.9 to pfSense, so those rules will do you no good. It will, instead, ARP on LAN for the MAC address of 192.168.0.9 and send the traffic directly to the destination host. pfSense will not be involved at all. That's how same-subnet traffic works.

Those commands show you how to do it in a decent switch. That is for a Brocade ICX if host 192.168.0.150 was plugged into switch port 1/1/4.

[jao]

ow I see, so to make this work I need to have separate interface  for my Server and my client to filter SSH access and other traffic? Is that right?

Thanks!

[Derelict]

Yes. If you want your router to be able to filter such traffic the server and host need to be on separate router interfaces.

[jao]

Ok got it Derelict

Thanks a lot!

1 Thank/s for you :)

[johnpoz]

I think your missing the point.. If you want to block client A from going to B that are all in the same network 192.168.1.0/24 for example..  Pfsense would have nothing to do with this traffic… You would have to route the traffic using pfsense as the router if you wanted it to firewall that traffic.  So A would have to be in say 192.168.1.0/24 and B would have to be in 192.168.2.0/24 where pfsense is the router between those segments.

[KOM]

You can do it via ssh_config:

AllowUsers jao@172.16.1.2

AllowUsers kom@192.168.1.*