Isolating Untrusted Devices at Switch Level

What do you do when you have a questionable device that you’d like to connect to your switch in order to get it online, but you don’t fully trust it and want to isolate it from your other devices? Or what if you don’t trust any of your devices to talk to each other but you still want to give them internet access? The textbook solution is to create separate VLANs and firewall them from each other at the router. This works, but there is just too much configuration for something so simple. An easier approach is to segregate them at the switch level. That way you can skip all the complexities of setting up a VLAN aware router. Sounds great, what’s the catch? The catch is that you do need a managed switch which supports IPv4 ACLs. Luckily, 1Gbps managed switches are not that expensive these days. In my setup I used and old Dell Powerconnect 6224. Similar syntax will apply to Cisco or HP switch. The general idea is that a managed switch has firewall-like features, so let’s use them.

Let’s look at a specific scenario:

  • LAN gateway IP 192.168.1.1/24
  • Port 1 and 2 with devices that have to be segregated from each other and from other devices on the same VLAN
access-list InternetOnlyACL permit ip any 192.168.1.1 0.0.0.0
access-list InternetOnlyACL deny ip any 192.168.1.0 0.0.0.255
access-list InternetOnlyACL permit ip any any

interface ethernet 1/g1
switchport access vlan 10
ip access-group InternetOnlyACL in 1

interface ethernet 1/g2
switchport access vlan 10
ip access-group InternetOnlyACL in 1

The following line is optional

access-list InternetOnlyACL permit ip any 192.168.1.1 0.0.0.0

What it does is make sure that the device can still ping the LAN gateway (important for some devices which verify internet connectivity by pinging LAN gateway) but for most they will happily connect to the internet without ever being able to ping the gateway IP (you just won’t see the first hop in your traceroute). This setup works with both DHCP and static IP assignments.

Caveat: This method blocks funny business on Layer 3 (IP protocol),but it will do absolutely nothing for you if the malicious device starts messing with your network at Layer 2 (ex ARP spoofing). For that you need to configure additional security features on your switch. This is just another layer of protection.