How to prevent some IP segments in the local area network (campus network) from logging into the external network

If you can set up a local area network, you need a router. I don't know your router model, but I can give you a general idea:

1. Enter the routing network management interface.

2. Enter the service page-> Ip filtering (or ip filtering-different manufacturers have different names)

Select "add"

Let the settings be completed .. Here are the settings of several main parameters.

1, and the rule id can be set to 10 or 15.

2. Action selection rejection (stop \ give up, etc.). )

3. Start \ end time, which can be set to the time when you don't want the ip to go online.

4. The source ip address is here. Set the ip of the two machines you need to disable (of course, it needs to be a local fixed ip ... of course, you can also set an IP segment).

You need to set an ip rule here. ..

Explain as follows.

Any: any source IP address. It: any source IP address that is numerically smaller than a specific address.

Lteq: Any source IP address with a value less than or equal to a specific address. Gt: any source IP address with a value greater than a specific address.

Eq: Any source IP address that is numerically equal to a specific address. Neq: Any source IP address whose value is not equal to a specific address.

Range: any source IP address within the range determined by numbers. Out of range: Any source IP address whose value is out of the determined range.

Self: IP address of ADSL/ Ethernet routing interface where this rule takes effect.

=======================

5. The destination ip address, this setting depends on you (it can be set to any or local area network segment ... If it is any, you can't access any network-including local area network. If the local area network segment is set, you can access the local area network, but you can't access the Internet).

=======================

6.TOD rule status is set to enabled.

7. The security level setting can be set to low or medium (remember here).

8. The direction is set to outward.

You can save the submission with permission.

After that, set the security level corresponding to your ip rules in the ip filtering interface, and other defaults should be ok (the default is as follows).

The public default operation chooses to accept.

Private default operation chooses to accept.

DMZ default operation selection denied

Router setup tutorial:

/s？ wd = % C2 % B7 % D3 % C9 % C6 % F7 % C9 % E8 % D6 % C3 % BD % CC % B3。 lm = 0 & ampsi = & amprn= 10。 tn = myie2dg & ampie = GB 23 12 & amp； ct = 0 & ampcl = 3 & ampf= 1。 rsp= 1

Cisco Router Configuration Manual:

/tests/ 199/ 1996 16 . html