Unidirectional communication filter between two VLANs

Block Traffic among two VLAN’s but only in one way, how to do that?

VLAN and VLAN configurations are very useful in all kinds of different ways. This configuration will be useful sooner or later for all network administrators out there.

UPDATE on 01 Sep 2017:
This article is about reflexive access-list which enable some sort of false statefulness for TCP traffic going through your router. After some feedbacks from my readers, I wrote another, a bit better article about reflexive access-list configuration so I suggest reading the other one as well.

It was a big challenge to resolve this tricky communication security requirement. The problem actually does not seem like a big deal but when you try to make it work you see that it is.

vlan-filter

The goal was to make unidirectional communication filter between two VLANs. The request was to allow VLAN 10 to access VLAN 20 but not the opposite. The computers from VLAN 10 needed to access resources in VLAN 20 normally but computers from VLAN 20 had to be prevented to access VLAN 10. 

There is a special type of Access list called reflexive.

This kind of access list will allow traffic from one VLAN to another only if the communication is established in other direction before that. It can’t be used for IP traffic but only for every protocol separately so you will need to use more rows in ACL to allow TCP, ICPM etc, but it will solve your problem.

Here is how is done:

Let’s say that you have two VLANs: VLAN 10 and VLAN 20.

VLAN 10 INTERFACE = 10.10.10.1 /24
VLAN 20 INTERFACE = 10.10.20.1 /24

VLAN 10 can access VLAN 20 but, VLAN 20 can’t access VLAN 10. That was the whole problem, to allow access only in one direction.
To be able to do so, you need to let the traffic from VLAN 10 go to VLAN 20 but you need also to let this communication to go back to VLAN 10 in order to close the communication bidirectional functionality. Almost every communication needs to get back to the source in order to make the circle functional.

But, if you allow this communication to go back to VLAN 10, you will alow all the communication in both ways, and this is the problem that we can solve using reflexive ACLs.

We will make extended named ACL with name EASYONE:

ip access-list extended EASYONE permit tcp 10.10.20.0 0.0.0.255 10.10.10.0 0.0.0.255 established
  • The work established at end of this ACL row means that this TCP traffic from VLAN 20 to VLAN 10 will only be allowed when it’s some communication that was started from VLAN 10, a going back traffic.
permit icmp 10.10.20.0 0.0.0.255 10.10.10.0 0.0.0.255 echo-reply
  • This echo-reply row will allow VLAN 20 to reply to ping and other ICMP requests
deny ip 10.10.20.0 0.0.0.255 10.10.10.0 0.0.0.255
permit ip any any
  • This row will deny all other traffic from VLAN 20 directed to VLAN 10 but with permit ip any any it will allow VLAN 20 to go let say to the gateway and further to the internet and other VLANs.

Finally, we will put the ACL EASYONE to VLAN 20 L3 interface

interface vlan 20
ip access-group EASYONE in

To conclude the config without comments, indeed easy now when is done:

ip access-list extended EASYONE
  permit tcp 10.10.20.0 0.0.0.255 10.10.10.0 0.0.0.255 established
  permit icmp 10.10.20.0 0.0.0.255 10.10.10.0 0.0.0.255 echo-reply
  deny ip 10.10.20.0 0.0.0.255 10.10.10.0 0.0.0.255
  permit ip any any
  exit
interface vlan 20
ip access-group EASYONE in

The credit for the solution goes to my mentor and friend Sandra who did the configuration and lab for it but more than that she came out with the established word at end of the ACL and whole reflexive ACL solution.

 

27 Comments

  1. dele August 25, 2014
  2. THIRUNAVUKKARASU November 19, 2014
  3. Gaurav February 6, 2015
  4. Muneeb March 4, 2015
  5. Ryan Good June 2, 2015
    • Ryan Good June 2, 2015
    • Valter Popeskic June 2, 2015
      • Ryan Good June 2, 2015
        • Ryan Good June 2, 2015
        • Valter Popeskic June 2, 2015
          • Ryan Good June 2, 2015
          • Valter Popeskic June 2, 2015
          • Valter Popeskic June 2, 2015
          • Ryan Good June 2, 2015
          • Valter Popeskic June 2, 2015
          • Ryan Good June 2, 2015
          • Valter Popeskic June 2, 2015
  6. Slawek April 15, 2017
    • Valter Popeskic May 12, 2017
  7. Hamada Ahmed May 11, 2017
    • Valter Popeskic May 12, 2017
  8. Excel Arcelo September 7, 2017
  9. Faisal September 13, 2018
  10. Faisal Ishfaq September 14, 2018
  11. Karlo Nico Amatorio February 16, 2019
  12. Mikey Moose March 8, 2024

Leave a Reply