I want to create a device of some sort where I am absolutely positive that only UDP traffic can pass one way. Of course I could setup whatever old router I might have, the thing is I want to make it as small as possible and with as little power consumption as needed. What components could or should I use for such an application?

  • 1
    \$\begingroup\$ An Arduino Yun would do the job well - the Linux portion of it runs OpenWRT so has all the firewall / routing facilities you could ever want. \$\endgroup\$
    – Majenko
    Sep 28 '14 at 19:32
  • \$\begingroup\$ So is there any other traffic at all? Writing a robust TCP/IP stack is hard. So if that is needed too, I'd strongly recommend a xBSD or Linux platform. \$\endgroup\$
    – gbulmer
    Sep 28 '14 at 19:57
  • \$\begingroup\$ There could be other traffic. The point being that all other packets should be dropped. \$\endgroup\$
    – wittrup
    Sep 28 '14 at 20:15
  • \$\begingroup\$ This would be trivial with a Linux iptables (firewall) installation. \$\endgroup\$ Sep 28 '14 at 21:10
  • \$\begingroup\$ "absolutely positive that only UDP traffic can pass one way". Do you meant that only UDP traffic can pass oneway, but all other traffic can pass both ways? Or only UDP traffic can pass and all other traffic is blocked, and that UDP traffic can only pass one way? Is this for security (you want to make sure information can only go one way on the connection)? If so, would it solve your problem to have an "information diode" rather than a "UDP diode"? With an "information diode", information can only flow in on direction regardless of protocol. \$\endgroup\$
    – bigjosh
    Feb 19 '15 at 17:31

You need a device with two ethernet ports and filtering capability. Such as an advanced router. Or if you posses the ability to program it, a micro-controller with two Ethernet interfaces or two interface chips and a lot software work.

UDP is a principle that has to be filtered out by a level of package inspection at least, at any lower level it's just bits passing through.

A router "certified" for UDP package filtering (there are plenty, if you pay attention) is probably the more affordable ready-made option you have, where you only need to click a few check boxes.

  • \$\begingroup\$ Routers are layer 3 devices, UDP is layer 4. Only advanced routers can do such filtering. \$\endgroup\$
    – venny
    Sep 28 '14 at 19:42
  • \$\begingroup\$ Ah crap, you are so right. Editing! -- Done editing, hope this "abiguized" the original post enough without actually changing it beyond recognition. Else, just discredit me ;-) \$\endgroup\$
    – Asmyldof
    Sep 28 '14 at 19:43
  • 1
    \$\begingroup\$ So maybe the easiest to fit all my specs are two lantronix xport and 1 atmel mcu with two rs232 ports. And then some software work. The bandwidth required is next to nothing. \$\endgroup\$
    – wittrup
    Sep 28 '14 at 19:53
  • \$\begingroup\$ I think @Majenko 's suggestion for an Arduino would be your lightest load. I know nothing of Arduino's though, so I'm counting on him to know. \$\endgroup\$
    – Asmyldof
    Sep 28 '14 at 19:56
  • \$\begingroup\$ The Arduino Yun is just a small Linux system running OpenWRT, with an AVR microcontroller attached (which you wouldn't use at all for this). There's no advantage to using it here over any other router. \$\endgroup\$
    – user39382
    Sep 28 '14 at 20:13

If you want, that information can go from A to B, but impossible to flow information from B to A, the simplest solution is:

make a special ethernet cable, where only one pair (the one carrying information from A to B) is intact, but the other pair (that would normally carry information from B to A), just cut that pair away.

This way, it is physically impossible to transfer the information to the wrong direction.

And, it does at least something to block TCP and allow only UDP:

Since TCP uses a handshake to connect, that connecting needs a two-way information path. Because that does not exist with such a modified cable, that causes the TCP handshake to always fail.

So UDP can go only to one direction, but TCP can not even connect successfully.

  • 2
    \$\begingroup\$ That isn't possible with gigabit Ethernet. All four pairs are used bidirectionally. \$\endgroup\$
    – user39382
    Jul 26 '17 at 20:03

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.