Unidirectional Subnet Communication

Question

Let me first begin by saying I've looked around, and I haven't found a question asked that pertains to this situation exactly.

Essentially my question is this:

Is it possible to allow subnet S1to access data from subnet S2, while preventing S2 from accessing data on S1?

For further information, let's say that both subnets are a part of Network N1, and that S1 is a staff subnet, while S2 is a student subnet. In this case, we want the teachers to be able to access data on the student computers without allowing the reverse to happen.

Is this possible? If so, how would you go about accomplishing it?

If there's any confusion, feel free to let me know so I can alleviate it!

Answer 1

Yes, this is possible. You need a device (e.g router, firewall, virtual appliance, etc) that does stateful firewalling.

The way in which it works is that it watches traffic that flows from the "trusted" zone to the "untrusted" zone. When "untrusted" devices send traffic in response to "trusted" devices, the firewall will let the traffic through. However, if "untrusted" devices try to initiate a connection to "trusted" devices, the firewall will block it.

I wrote a blog post about this some time ago which demonstrated how stateful packet inspection (SPI) works.

Answer 2

That is the sort of thing firewalls do.

A couple of examples:

• Users on a network can access resources on the Internet, but Internet users can't access the network.
• Test labs are done this way, so that the lab cannot damage the production network, but the testers on the production network can run things in the lab.

Just separate the two networks with a firewall, and set up the firewall rules to allow, or not, traffic in the manner you choose.