Network Attached Storage (NAS) devices are useful for storing and sharing files across a Local Area Network (LAN). However, connecting a NAS to two different Wi-Fi networks can be a security risk as it may expose sensitive data to the public internet. In this article, we will explore how to isolate NAS internet access while keeping LAN access in a Linux system.
Understanding the Network Environment
Typically, a NAS device connects to two different Wi-Fi networks, depending on its location. This dual connectivity can pose a security threat as it may expose the NAS device to the public internet. Although most NAS devices come with built-in security features, it is always a good practice to implement additional security measures.
The Problem: Unintended Internet Access
When a NAS device is connected to a Wi-Fi network, it can be accessed from the internet if port forwarding is enabled on the router. This exposes the NAS device to potential security threats such as data breaches, malware attacks, and unauthorized access. Therefore, it is crucial to isolate the NAS device from the internet while keeping it accessible within the LAN.
The Solution: Isolating NAS Internet Access
The solution is to configure the Linux system hosting the NAS device to only allow LAN access. This can be achieved by blocking all incoming traffic from the Wi-Fi network connected to the internet.
Using iptables to Block Incoming Traffic
The Linux system's firewall can be configured using iptables. The following command blocks all incoming traffic from the Wi-Fi network connected to the internet:
iptables -A INPUT -s -j DROP
Replace
Configuring Local Network Access
After blocking all incoming traffic from the internet, it is necessary to configure local network access. This can be done by allowing incoming traffic from the LAN's IP address range. The following command allows incoming traffic from the LAN:
iptables -A INPUT -s -j ACCEPT
Replace
Implementing Persistent Configuration
To ensure that the iptables configuration persists across reboots, it is necessary to save the configuration. The following command saves the iptables configuration:
iptables-save > /etc/iptables/rules.v4
This command saves the iptables configuration to the /etc/iptables/rules.v4 file, ensuring that the configuration is loaded on every system startup.
Isolating NAS internet access while keeping LAN access in a Linux system can be achieved by blocking all incoming traffic from the Wi-Fi network connected to the internet and allowing incoming traffic from the LAN. This can be done using iptables on the Linux system hosting the NAS device. Persisting the configuration across reboots is necessary for long-term security.
References
-
Book: Linux Firewalls.
-
Article: Configure iptables Firewall on Linux.
-
Online Resource: Allowing All Incoming Traffic on a Particular Port.