[SOLVED] How to be sure that a device on the local area network is not accessible over internet?

[ChessKnight]

How can I check that a device connected to my local area network (LAN and WAN) is not accessible from outside over internet?

I use a router and its firewall seems enabled but I want to be sure that it actually works.

 

[bill001g]

By default the NAT in your router prevents it. When traffic comes into your router from a unkown location and wants to send data to a machine in your lan the router does not know which machine to send it to so it just discards it. This is why you have to have port forwarding rules to tell the router where to send certain traffic.

The firewall in a router does very little since the nat has already blocked almost all traffic. You generally only want the firewall features that protect the router itself any form of traffic filters will greatly degrade the speed if you have a fast internet connection.

In general the best way to prevent a machine from talking to the internet is to leave the gateway and dns fields blank or set to a invalid value. This way even if something on the outside were to get to the machine it has no ability to respond since it does not know the gateway (ie router) is to send traffic. This of course only is used on a device that need no access ever to the internet.

 

[ChessKnight]

By default the NAT in your router prevents it. When traffic comes into your router from a unkown location and wants to send data to a machine in your lan the router does not know which machine to send it to so it just discards it. This is why you have to have port forwarding rules to tell the router where to send certain traffic.

The firewall in a router does very little since the nat has already blocked almost all traffic. You generally only want the firewall features that protect the router itself any form of traffic filters will greatly degrade the speed if you have a fast internet connection.

In general the best way to prevent a machine from talking to the internet is to leave the gateway and dns fields blank or set to a invalid value. This way even if something on the outside were to get to the machine it has no ability to respond since it does not know the gateway (ie router) is to send traffic. This of course only is used on a device that need no access ever to the internet.

Thank you for your reply. The device I want to block from internet access is a Seagate Central drive. It has following settings in its admin panel:

Network mode: DHCP Client OR Static
IP address: 192.168.1.x
Netmask: 255.255.255.0
Default Gateway: 192.168.1.x
DNS servers: [x] Obtain DNS server address automatically (If uncheck this I can add two DNS server addresses)

It does not let me leave default gateway and DNS server addresses as blank.

How should I configure these options to block internet access from/to this device but keep it accessible over LAN?

If I set those addresses as a non-existing local IP, such as 192.168.1.0, would it be a good solution?

 

[bill001g]

It likely will not let you put in .0 You can use any other non used address. 192.168.1.253 tends to be one that is seldom used. Even if a machine was assigned that IP it will not act as a router and will just get garbage traffic.

 

[USAFRet]

Thank you for your reply. The device I want to block from internet access is a Seagate Central drive. It has following settings in its admin panel:

By default, the router prevents unauthorized access attempts from 'outside'.
Us out here can't even see that drive and its 192.XXX IP address.,

 

[ChessKnight]

By default, the router prevents unauthorized access attempts from 'outside'.
Us out here can't even see that drive and its 192.XXX IP address.,

Oh, so did you try to see it?

Thank you for confirmation!

 

[USAFRet]

Oh, so did you try to see it?

Thank you for confirmation!

192.168.x.x is strictly internal. Dispensed from your router.
One would have to know your public IP address (given to you by your ISP), and then your router would have to be set to port forward requests to that 192.168.whatever internal IP.