I don't know much about networking security other than keeping unused ports closed is good. This is what I'm trying to accomplish:I need to be able to keep my server (the dotted line) with limited access to the Internet, but full access to the other devices on the network. I only want to have my home server connect to the net for updates (via apt-get) or for wget'ing some files sometimes. Is there a way to block the net off but let it by easily for software updates?I'm going to be running an apache web server from the server, but it should only be available to other devices on my network. I don't want someone being able to connect to it through the net. How can I do this securely?Basically I need a full web server accessible from my network but not from the internet (unless I specifically ask it to).
How to set this home network mesh up
ssh;networking;webserver;home
I assume that your gateway device to the internet does NAT (network address translation), i.e. your home network uses for example a private network like 192.168.0.* and you dynamically get one IP from your ISP which is used by the gateway.In that case someone on the internet only is able to access port 80 on your home network web-server, when you have explicitly configured a port forwarding of port 80 to the web-server on your gateway.Besides checking the gateway configuration you can also check it from a system with a different IP. Get the current external IP of your gateway and try to access port 80 from the other IP. And/or use nmap on it.Edit: On the LAN, on a linux system you can lookup the configured IP addresses via:$ ifconfig | grep -A1 encapeth0      Link encap:Ethernet  HWaddr 01:02:de:ad:be:af          inet addr:192.168.1.1  Bcast:192.168.1.255  Mask:255.255.255.0--lo        Link encap:Local Loopback            inet addr:127.0.0.1  Mask:255.0.0.0In this example it is on the 192.168.1.* network, which is a private address range, i.e. one need a gateway that does NAT for internet access:$ route -nKernel IP routing tableDestination     Gateway         Genmask         Flags Metric Ref    Use Iface192.168.1.0     0.0.0.0         255.255.255.0   U     1      0        0 eth00.0.0.0         192.168.1.42    0.0.0.0         UG    0      0        0 eth0Meaning that the gateway has the IP 192.168.1.42 on the LAN.Usually all this is automatically configured via DHCP - where e.g. the DHCP server runs on the gateway device.To get the external IP address of the gateway one can use the administrative interface of it or browse an internet site that displays it, e.g.$ curl -s http://www.lawrencegoetz.com/programs/ipinfo/ | grep -A1 'Your IP'<h1>Your IP address is<BR>    64.34.119.12(don't know this service - via google you can find a lot of alternatives)