Set Route Blocking LAN virus propagation path (1)

There is no doubt that the LAN is a "hotbed" of viruses and Trojans ". Poisoning on a client often affects other clients or even the entire LAN. In this case, the bandwidth is swallowed up, and network faults may even paralyze the entire network. All these problems make the network administrators talk about the virus. In fact, deploying on special nodes in the LAN can effectively block virus transmission routes and prevent catastrophic consequences caused by viruses. Among them, routers are critical network nodes. The following uses a Cisco router as an example to describe how to block a LAN virus.

1. Blocking Principle

Can routers, as key devices in the network, block virus infections? The vro acts as the channel for cross-network access to the internal PC. If we limit these ports, it can prevent viruses from entering through the Internet through the vro, and also prevent internal viruses from spreading out the virus through the vro.

When a vro is switched to the Internet as a NAT address, the firewall is configured to restrict all packets on the dangerous target port, in this way, the router that initiates an attack on the Intranet from the Internet blocks the virus attack packets and cannot access the Intranet.

In addition, if the internal PC is infected with a virus, the attack packets of the virus cannot be transmitted to the external network through the router. It should be noted that preventing virus propagation through routers is based on the LAN subnet division. If there is no specific subnet virus infection, it cannot be blocked, because the network transmission of PCs in the same network segment is not forwarded through the router. Fortunately, large local networks are divided into subnets, and subnets are directly isolated through routers/switches.