LAN Host Segregation

LAN Host Segregation KB ID 0001947

Problem: LAN Host Segregation

I’m currently working with a client who provides bespoke software services to a number of end customers. Like many organisations that have grown organically over the years, their infrastructure estate is made up of a sizeable collection of physical servers, each delivering applications and services to different customers.

As part of a wider modernisation programme, we’re looking at moving those workloads into an Infrastructure as a Service (IaaS) platform. On the face of it, a straightforward lift-and-shift migration would get the servers out of the datacentre and into the cloud with minimal disruption. Job done, right?

Well, not quite.

One of the challenges with the existing environment is that every server sits on the same VLAN. There is no meaningful segregation between customers, applications, or service boundaries. Historically that may have made management simpler, but it also means that security, containment, and operational risk are all concentrated into a single flat network.

Simply migrating those workloads into IaaS without addressing the underlying network design would mean we’d be taking the same architectural problems and recreating them in a different location. We’d gain the benefits of cloud hosting, but we’d still be carrying around many of the same networking and security challenges.

In this article, I’ll look at one relatively simple approach that can improve matters without introducing additional licensing costs or requiring a wholesale redesign of the environment.

Now, before my inbox fills up, yes, I know micro-segmentation is the “right” answer. If budget, time, and resources are unlimited then implementing a properly segmented, policy-driven architecture would be my preferred recommendation every day of the week. However, that’s not always the reality we work in.

What follows is not a replacement for micro-segmentation. It’s simply a pragmatic, cost-neutral step that can improve isolation, reduce risk, and make the eventual journey towards a more mature network architecture a little easier.

Examples:

Shared office networks
Guest PCs
Lab environments
Preventing lateral movement

Solution: LAN Host Segregation

Points to note before proceeding with LAN Host Segregation

These server are all ‘Windows Based’ So I’m going to use the windows firewall to block ‘host-to-host’ communication.
They are also all stand-alone machines so I don’t need to worry about Active Directory memberships or communication.
They are all statically IP addresses so I don’t have to worry about DHCP.
they all use external DNS so I don’t need to worry about talking to ‘internal’ DNS servers.

Remember

Blocking LAN traffic means:

No SMB
No RDP
No UNC paths
No printer sharing
No remote management

Our first task is to locate the LAN address we are currently using, run ncpa.cpl, and open the properties of your machines NIC.

Under IPv4 you will see your IP address and subnet mask, in my case 192.168.110.0/24 (if you don’t understand that go an ask a network engineer!).

Open Windows Defender Firewall with Advanced Security. Outbound Rules > New Rule > Custom > Next.

All Programs> Next > Protocol type = Any > Next > Under REMOTE IP Addresses add in your subnet > Next.

Block this connection > Next > Next > Give the rule a sensible name like “Block-LAN-Outbound > Finish

Inbound Rules > New Rule > Custom > Next

All Program s> Next > Protocol Type = Any > Next > Under REMOTE IP addresses add in you LAN subnet > Next.

Block the connection > Next > Next > Give the rule a sensible name like “Block-LAN-Inbound > Finish

Finally we need to ALLOW traffic to the default gateway (router or firewall that’s the next-hop towards the internet). Outbound Rules > New Rule > Custom > Next

All Program s> Next > Protocol Type = Any > Next > Under REMOTE IP addresses add in your Router/Default Gateway IP > Next.

Allow the connection > Next > Next > Give the rule a sensible name like “Allow-Router-IP > Finish

Then ensure internet access works OK.

Deploying LAN Host Segregation with PowerShell

To do the same from PowerShell is pretty easy, to block all outbound connections to your local LAN

# Block outbound to the rest of the LAN
New-NetFirewallRule -DisplayName "Block-LAN-Outbound" `
    -Direction Outbound `
    -Action Block `
    -RemoteAddress 192.168.110.0/24 `
    -Profile Any `
    -Program Any

To block all communications from your local LAN.

# Block inbound from the LAN
New-NetFirewallRule -DisplayName "Block-LAN-Inbound" `
    -Direction Inbound `
    -Action Block `
    -RemoteAddress 192.168.110.0/24 `
    -Profile Any `
    -Program Any

And finally to allow communication with the default gateway.

# Allow outbound to the router (default gateway)
New-NetFirewallRule -DisplayName "Allow-Router-Outbound" `
    -Direction Outbound `
    -Action Allow `
    -RemoteAddress 192.168.110.1 `
    -Profile Any `
    -Program Any

Why This Works?

Windows Firewall blocks RFC1918 LAN traffic
Router IP is explicitly allowed
Internet traffic uses public IP ranges, so it bypasses the block
Result: hosts isolated, internet intact

Problem: LAN Host Segregation

Solution: LAN Host Segregation

Points to note before proceeding with LAN Host Segregation

Deploying LAN Host Segregation with PowerShell

Why This Works?

Related Articles, References, Credits, or External Links

Submit a Comment Cancel reply