1

I'm currently have a bit of an issue setting up a network infrastructure that I need help with. My network infrastructure is:

                                                              ____ ____________
                                                             |    |10.4.0.0/24
             _________________                     __________|Sys1|____________
            |                 |                    | 10.0.8.1|____|10.8.0.0/24
            |      Main       |                    |          ____ ____________
vpn_clients_|  Network router |_system_connections_|_________|    |10.4.1.0/24  
10.0.4.0/22 |                 |   10.0.8.0/22      | 10.0.8.2|Sys2|____________
            |                 |                    |         |____|10.8.1.0/24 
            |_________________|                    |
                                                   |_________ ...
                                                    10.0.8.x

I would like anyone in the 10.0.4.0/22 or even 10.0.8.0/22 network to access any of the 10.4.x.y or 10.8.a.b networks, but prevent communications between downstream equipment (eg. 10.8.1.3 talking to 10.4.0.2)

Is that a possibility within OSPF? If so, I'd appreciate if someone could show me the ropes.

Cheers!

Improve this question
5
  • 2
    You use a routing protocol, like OSPF, to share routes between routers. You use a firewall or ACLs on routers to prevent or allow specific traffic.
    – Ron Maupin ♦
    Nov 13, 2016 at 20:16
  • What are the "Sysx" devices?
    – Ron Trunk
    Nov 13, 2016 at 22:17
  • They are just linux boxes with Quagga installed on them
    – adalal
    Nov 13, 2016 at 23:25
  • 2
    This is not possible with OSPF , even without any routing protocol 10.8.1.x and 10.4.1.x will be able to see each other , to deny this you need to run some sort of firewall like IPtables
    – Mr.lock
    Nov 14, 2016 at 9:04
  • Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you could provide and accept your own answer.
    – Ron Maupin ♦
    Aug 15, 2017 at 5:19

2 Answers 2

Reset to default
1

OSPF could work here. I'm not familiar with Quagga, but in a standard setup you could put every interface in the same area and use import policies on Sys1 and Sys2 to prevent them from learning each-ther's downstreams (note you can't set export policies with OSPF), OR put each Sys in a separate area: all areas would be present on the Main router, but only one area would be on each Sys device. The second method would probably be preferred.

  • 10.0.4.0/22 area 0 passive on router
  • 10.0.4.0/22 area 1 passive on router
  • 10.0.8.0/22 area 0 active on router and each system
  • 10.0.8.0/22 area 1 active on router and each system
  • 10.x.0.0/24 area 0 passive on Sys1 only
  • 10.x.1.0/24 area 1 passive on Sys2 only

Firewall filters and just putting everything into a single area would be MUCH easier. BGP might be better if you must use a routing protocol here since import and export policies per-neighbor give you much more control and you'd need to add a whole new area on everything per Sys you turn up.

Improve this answer
0

You would probably like to use netfilter for that. Using iptables utility you can easily restrict or allow communication in the way you described. It's irrelevant of how you perform routing. If OSPF was the choice for sake of access control only, you can replace it with static routing.

Improve this answer
1
  • Unfortunately, new sysX boxes are added and connects back via VPN, so, static routing isn't an option as the 10.0.8.0/22 addresses are added by DHCP (although DHCP reservation is an option).
    – adalal
    Nov 14, 2016 at 19:31

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.