Unable to block internal communication

I don't think this is possible.  For the reason you mentioned, both clients are on the same subnet, which means the rules in UTM don't apply because traffic never goes through the default gateway.

I think there's several ways to deal with this.

1) vlans - by having devices on different vlans forces them to communicate through the UTM.  This may introduce additional latency or have other effects

2) Managed switches may have security features to configure such a rule.

What type of data are you trying to block between the two pc's?

I don't think this is possible.  For the reason you mentioned, both clients are on the same subnet, which means the rules in UTM don't apply because traffic never goes through the default gateway.

I think there's several ways to deal with this.

1) vlans - by having devices on different vlans forces them to communicate through the UTM.  This may introduce additional latency or have other effects

2) Managed switches may have security features to configure such a rule.

What type of data are you trying to block between the two pc's?

Hi Jay Jay, thanks for the quick reply!

This computer 23 receives employees times from the device 56. The thing is: there are around 4 persons that connect every a few minutes to retrieve the new data (we don't know why), and this is making our device 56 runs slowly and we had DB issues (corrupted data) 3 times this year already (we believe that's due the high checking frequency). We tried to talk to them to check only when necessary, but this "rule" only works on the first week, then everything goes backs to "normal".

We tried to use the HOSTS file to block the connection, but the HOSTS file does not work with IPs :/

We are looking for a kind of software firewall that can be enable-disable remotely, but we didn't found any yet :(
That way we can set a time to retrieve the data. For example, between 07:00-08:00, 11:00-11:30, 14:00-14:30 and 17:30-18:30

Thanks again!

Fabiano Melo said:

This computer 23 receives employees times from the device 56. The thing is: there are around 4 persons that connect every a few minutes to retrieve the new data (we don't know why), and this is making our device 56 runs slowly and we had DB issues (corrupted data) 3 times this year already (we believe that's due the high checking frequency). We tried to talk to them to check only when necessary, but this "rule" only works on the first week, then everything goes backs to "normal".

Perhaps your strategy should be to determine why those clients are trying to connect so often.  Maybe something in group policy can be configured for the pc's in question.  Or better yet determine what is connecting and why.

As I mentioned, the only solution I can think of is some kind of blocking on a switch level.

Another idea is to configure computer 23 to only receive data from device 56.  Is this a windows pc?  OS version?  If I recall windows firewall allows you to create such permissions.

So, they told my colleague once that they need to check always they see someone (employee) in the parking lot or somewhere else and check if that person punched out. The #1 rule is to punch out always that you are leaving the office. But, honestly, I don't see too many people leaving the office during the day. I think they could write down who they saw out of the office, as the time and then check only once a day. Don't need to connect every 15 minutes...

The problem using Windows Firewall is because we are trying to avoid having to RDC to this computer to enable, then disable, then enable... and so on, all day long. That's why we are looking for a way to do this by Sophos, or HOSTS file (that can be editable remotely. Just need to keep the file open on our computer and save with on or off, for example), or even through the DC computer, with no luck yet. :(

We tried a couple of simple firewalls to use with a macro and scheduled task, but they did not work as expected.

The computer 23 is a virtual Windows 7 computer.

Thanks for the help!