How can I use ipfw (or another tool, if one is available) to allow unlimited access between computers on my LAN, but not allow access to the Internet?
(The IPs on my local LAN are 192.168.0.xxx)
-
Turning off the internet router/modem is not an option I assume? Or just unplugging the cable between the router and your internet provider? Should the access restrictions apply to all users or only to specific ones?– nohillside ♦Commented Dec 10, 2011 at 11:55
-
Yes. In my specific case, I want one computer to be able to access the Internet, but not the others.– TJ LuomaCommented Dec 14, 2011 at 19:28
Add a comment
|
4 Answers
Has been a while since I've used ipfw but running the following commands on all relevant computers should do the trick:
sudo ipfw -f flush
sudo ipfw add allow tcp from me to 192.168.0.0/24
sudo ipfw add allow ip from me to 192.168.0.0/24
sudo ipfw add deny tcp from me to any
sudo ipfw add deny ip from me to any
To disable just run sudo ipfw flush again
answered Dec 10, 2011 at 12:36
-
This seemed to work perfectly. Thanks! (Adding -f before 'flush' kept it from asking for confirmation, which was what I wanted.)– TJ LuomaCommented Dec 14, 2011 at 19:34
The crudest way I can think of to do this, assuming your network is based on static IPs, is to just not populate the "Default Gateway" IP in the network configuration.
If you are on a DHCP network, you could change the DHCP server configuration, but that would break the internet access of all computers on the LAN, not just some of them.
answered Dec 10, 2011 at 11:49
As I was looking for an answer to this, I found another way to do it which does not use ipfw. I'll mention it here in case anyone else is looking for a similar answer later.
The other way to do this is to set the DNS servers to 0.0.0.0.
This can accomplished on the command line using networksetup like this:
networksetup -setdnsservers Wi-Fi 0.0.0.0
If you have an Ethernet connection, you will want to use
networksetup -setdnsservers Ethernet 0.0.0.0
To revert this change, I was able to use 'empty' instead of '0.0.0.0'
networksetup -setdnsservers Ethernet empty
but, depending on your network setup, you may need to specify the actual IP address of your DNS servers instead of using empty.
I still think ipfw is a better tool for the job, but I mention this just in case someone prefers it.
The reason this works for allowing access to other computers on my LAN is that I can access them using hostname.local. instead. For example, the hostname for my MacBook Air is 'air' so I can use ssh air.local. to connect to it, even without DNS servers.
you can use ipfw to block all traffic to port 80 which is http. You will need to check if you also need to block other ports e.g. 443, 110, 993 etc
From the comment below, did you want to have http access between machines on your network? If so just do above and then add the exception to allow http to machines on your ip range. e.g. /24 if thats what your network is.
-
well just add an exception for them ip's on that port. updated my answer– lennardCommented Dec 10, 2011 at 11:37
-
Have you still not read the question? He wants everything accessible from the LAN, and nothing accessible from the WAN. Doing that on a port-by-port and ip-by-ip basis is idiotic. Commented Dec 10, 2011 at 11:46
-
he won't be typing in every ip just allow /24 for example. personally i would do this on a router so everyone in the subnet gets exactly what he's asking for but he want's to use a different tool such as ipfw– lennardCommented Dec 10, 2011 at 11:53