many options, here are two:
-
you can set manual IPs on the terminals and simply don't set a default gateway.
-
you can use literally any proper, business router and create the required access rules.
this post was submitted on 25 Nov 2023
1 points (100.0% liked)
Home Networking
238 readers
3 users here now
A community to help people learn, install, set up or troubleshoot their home network equipment and solutions.
Rules
- Please stay on topic.
- Please use the search function to look for keywords related to what you want to ask before posting since most common issues have been answered.
- No Ads. This community is for support and discussion. Ads and self promotion are not welcome here.
- No product reviews or announcements. If you have a question about a product, be specific about what you want to know.
- Be civil. Don't be a jerk. Not being a jerk is surprisingly easy.
- No URL shorteners. URL shorteners tend to hide the real use of a link. For this reason, please use normal links, even if they're long.
- No affiliate links.
- No gatekeeping. With profession shall come professionalism. Extend help without judging others for their ignorance. The same goes for downvoting of comments or posts for "stupid questions" or not being as knowledgeable as others.
founded 1 year ago
MODERATORS
I have read about your first suggestion. This sounds simple enough but I was worried that it would break the TCP/IP connection between the computer and the debit terminal. I am guessing it won't??
I think most routers can block internet access with mac address or ip address. Doesn't need to be business router.
Throw in a Dell Sonic Wall, and make the POS company happy. They're the industry standard for a reason, where I wouldn't use a consumer based product for this instance, due to the security issues with many of them. They want a SECURE firewall in front of those terminals, and it keeps you in compliance with the latest rules.
Reading what you have, your current system is not in compliance, with the debit machines accessing the internet with NO FIREWALL. The fines are not cheap, if something happens.
I'm not sure I understand the need/concern here, you're jumping straight to the solution you want, not necessarily need.
What form factor are the POS terminals? iPads, Windows, custom? By default they won't allow incoming connections anyway. If you've got them locked down to a kiosk mode so they only run the POS software and users can't play with any settings then they're only going to reach out to legit destinations.
You also need to ensure the terminals are kept up to date, aggressively patch them.
Most routers now have a guest network mode. The simplest network protection for you right now is probably to put your terminals on the main network and everyone else uses the guest network or vice versa.
nah you arent understanding what he asked for.
old configuration:
-POS terminals on a local non internet connected network.
-Debt machines on a seperate network that is connected to the internet
-Debt machines connected to POS terminals via serial cable.
New Setup:
-Debt machines will communicate with POS terminals through the TCP/IP network.
-therefore, the POS machines will theoretically now have network access to the internet.
Yeah I got that. I don't see the issue though. The previous connection could still be exploited, it's not like the serial cable stops comms.
I don't see the issue with the POS terminals having access to the internet. It's not going to allow inbound connections and the outbound connections will make it much easier to keep them up to date.
Unless I'm missing something here it sounds like they're trying to make their network unnecessarily complex for no security gain.
you are 100% correct that his systems arent air gapped before and they arent air gapped going forward.
that doesnt mean that there is no point doing anything in the middle.
some people are very paranoid about having financial data on any system that can access the internet. i was treating this as besides the point of the question OP asked and was keeping status quo. it is possible they are running outdated software that cannot have security vulnerabilities patched and that a decision somewhere has been made to keep these devices off of direct internet access.
there is nothing wrong with that.
Absolutely agree. If he's running POSs with outdated software then keeping it away from the internet is sensible. I think we're all making assumptions and we need more info on the devices, software, and the other use cases for the network before we can give any concrete advice.
If you know the MAC address, you can ban/restrict from there
You can configure a non existent proxy server on the pos systems and they will not be able to access the internet only local devices .
Assign a static IP address the nic at each PoS computer with a bogus gateway ip address and no DNS server entry.
That computer won't find the internet but still will communicate on the local lan.
Then add hostname/address pairs in its HOSTS file as needed.