Server security

[castoffs]

(21-06-2013 16:46)simoncn Wrote:  

(21-06-2013 15:13)simoncn Wrote:  Did you investigate my suggestions of using a subnet or VLAN? Is there a problem with these approaches?

It might be helpful for me to explain this approach in a bit more detail. It divides a single physical network into multiple logical sections, where the machines in one section can't access those in another section. It's possible to set up routing between the sections to provide limited access between the sections for specific purposes.

With this approach, you'd need to put your audio server, audio renderer and control point in one section, and put the other machines that you want to exclude from having access to your audio server in the other section.

I like the principal but I couldn't find a comprehensible description of how to achieve it. I did try.

[simoncn]

(21-06-2013 18:14)castoffs Wrote:  I like the principal but I couldn't find a comprehensible description of how to achieve it. I did try.

Unfortunately it does require a fairly advanced knowledge of networking to set this up.

Can you give more details about your networking setup and the devices you want to exclude from having access to MinimServer?

[castoffs]

I have a primary wireless router (dd-wrt) to which the w8 pc running the server is connected to by ethernet cable. Also connected to this primary wireless router is another wired router to which all my media devices are connected to by ethernet cable including a linn player, sat box, dvd player &tv all acessing the same w8 pc. the Linn/Minim connection is controlled by an Android tab using Bubble connected through the primary wireless router by wireless.

The problem is that anyone can connect wirelessly to the primary wireless router or to a third wireless router connected by ethernet cable to the primary wireless router. Therefore anyone can use a control app to play or download my music through Minim.

[simoncn]

(21-06-2013 22:11)castoffs Wrote:  I have a primary wireless router (dd-wrt) to which the w8 pc running the server is connected to by ethernet cable. Also connected to this primary wireless router is another wired router to which all my media devices are connected to by ethernet cable including a linn player, sat box, dvd player &tv all acessing the same w8 pc. the Linn/Minim connection is controlled by an Android tab using Bubble connected through the primary wireless router by wireless.

The problem is that anyone can connect wirelessly to the primary wireless router or to a third wireless router connected by ethernet cable to the primary wireless router. Therefore anyone can use a control app to play or download my music through Minim.

Thanks for explaining this. You should be able to do what you want by adding an incoming connection rule to the Windows firewall on the server PC to restrict incoming TCP connections to MinimServer (ports 9790 and 9791) to the Android tab and Linn DS only.

For this, you'll need to configure the primary router to assign DHCP fixed IP addresses for the Android tab and the Linn DS. You need to specify the MAC addresses for these devices and the IP addresses that you want the router to assign when these devices connect using DHCP. You'll also need to set the ohnet.port property in MinimServer to 9791. The http.port property is set to 9790 by default.

The next step is to disable any existing Windows firewall incoming connection rules that are allowing TCP access to the program 'Java (TM) Platform SE binary'.

You can now select Advanced settings > Inbound Rules > New Rule in the Windows firewall to create a firewall rule that specifies a list of devices that are allowed to access ports 9790 and 9791. In the New Rule wizard, do the following:

1) For Rule Type, select Custom
2) For Program, select All programs
3) For Protocol type, select TCP
4) For Local port, select specific ports 9790-9791
5) For Remote port, seect All ports
6) For local IP address, select Any IP address
7) For remote IP address, add the IP addresses of your Linn DS and Android tab
8) For Action, select Allow the connection
9) For Profile, check the Private box
10) For Name, type MinimServer Access

I've tried this myself, and it works. It's not completely secure because it would be possible for a determined intruder to "spoof" an IP address on the allowed list, but it will protect you from casual unauthorized access.