Solved

Restricitng access to a IP range

Posted on 2013-06-18
7
157 Views
Last Modified: 2013-06-24
Hi,

We have some PLC's at a remote site that use a 10.0.0.0 subnet. These are normally accessed via VPN by directly VPNing into the site. I would like to change this procedure, so the tech's that access these PLC's need to VPN into our main site and then be routed to the remote site.

So I don't have to get our ISP to doing any route changes for us I would like to change the PLC's ips to be included in the normal site subnet of 192.168.8.0/24. To do this I need to restrict access to the IPs we allocate to the PLC's.

So for example I would have a range of 192.168.8.200-210 for the PLC's and the only people that should be able to access this range would be a security group - PLC tech. Can I use either DNS or group policy to allow this to happen?

Thanks
0
Comment
Question by:Balco
  • 4
  • 3
7 Comments
 

Expert Comment

by:jensenjl
Comment Utility
Can you configure a site to site vpn between the firewalls at each location?  

I have many multi-site networks that use different IP scopes.  Each remote site is connected via site to site vpn and each site is able to access other sites as if it were local.
0
 

Author Comment

by:Balco
Comment Utility
We have a private IP Network through our ISP which ensures we can access each site as if it was locally just on a different subnet. Our main site is on subnet 192.168.1.0 and the remote site main subnet is 192.168.8.0. I can access the 8 subnet as this is fully routed through our site routers and the private IP network.

The 10.0.0.0 subnet has not been routed at this stage and is only accessible by VPNing to that site or logging into the DNS server onsite as the DNS server.

If I can put the PLC's onto the 192.168.8.0 subnet and secure the IP range it will mean I dont have to get our ISP involved with router changes and the Techs can just VPN into our main site and see the PLC's
0
 

Expert Comment

by:jensenjl
Comment Utility
Could you put those devices in a DMZ and restrict DMZ access to the VPN users?
0
Backup Your Microsoft Windows Server®

Backup all your Microsoft Windows Server – on-premises, in remote locations, in private and hybrid clouds. Your entire Windows Server will be backed up in one easy step with patented, block-level disk imaging. We achieve RTOs (recovery time objectives) as low as 15 seconds.

 

Expert Comment

by:jensenjl
Comment Utility
Or is it possible to use a VLAN and have the VPN users as part of the same VLAN?
0
 

Author Comment

by:Balco
Comment Utility
It is possible to have another VLAN, but once agian that will involve our ISP provider making changes, which it it looking like what we might have to do.

The only other way is to pur some security on the switch that sits in fron of the PLC's.
0
 

Accepted Solution

by:
Balco earned 0 total points
Comment Utility
We have decided to shift the PLC's into the 192.168.8.0 subnet since you need special software to edit these and beleive it is a minor risk that someone will be able to do this who is not authorised
0
 

Author Closing Comment

by:Balco
Comment Utility
This is not a total soltuion with security
0

Featured Post

Get up to 2TB FREE CLOUD per backup license!

An exclusive Black Friday offer just for Expert Exchange audience! Buy any of our top-rated backup solutions & get up to 2TB free cloud per system! Perform local & cloud backup in the same step, and restore instantly—anytime, anywhere. Grab this deal now before it disappears!

Join & Write a Comment

Suggested Solutions

Title # Comments Views Activity
FORTIGATE FSSO Problems 5 77
Process to setup port forwarding on Juniper SSG-5 firewall 5 47
Nessus scan 5 84
RDP Sonicwall 8 22
A few customers have recently asked my thoughts on Password Managers.  As Security is a big part of our industry I was initially very hesitant and sceptical about giving a program all of my secret passwords.  But as I was getting asked about them mo…
Using in-flight Wi-Fi when you travel? Business travelers beware! In-flight Wi-Fi networks could rip the door right off your digital privacy portal. That’s no joke either, as it might also provide a convenient entrance for bad threat actors.
Internet Business Fax to Email Made Easy - With eFax Corporate (http://www.enterprise.efax.com), you'll receive a dedicated online fax number, which is used the same way as a typical analog fax number. You'll receive secure faxes in your email, fr…
This video gives you a great overview about bandwidth monitoring with SNMP and WMI with our network monitoring solution PRTG Network Monitor (https://www.paessler.com/prtg). If you're looking for how to monitor bandwidth using netflow or packet s…

762 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

11 Experts available now in Live!

Get 1:1 Help Now