blocks|key|4415323|text|基本上，您只需要在两者之间设置一个防火墙，具有非常严格的规则，基本上就是所谓的“拒绝所有”规则，然后只允许一个单一的方法点到单个端口输出规则来满足您的需要。这对于一个安全/网络的家伙来说很容易，并且对你的客户应该是满意的。|type|unstyled|depth|inlineStyleRanges|entityRanges|data|entityMap^0^^$0|@$1|2|3|4|5|6|7|C|8|@]|9|@]|A|$]]]|B|$]]

Basically you just need a firewall between the two with really tight rules, basically something called a 'Deny all' rule and then just allow a single one way point to point single port outgoing rule for what you need. This is easy for a security/network guy and should be satisfactory for your client.

blocks|key|4415353|text|我不认为他们是偏执狂，我为他们对待安全的态度而鼓掌。|type|unstyled|depth|inlineStyleRanges|entityRanges|data|4415354|如果他们遇到了独立网络的麻烦，他们可能也会遇到安装防火墙的麻烦。防火墙中的一个小漏洞只允许25端口上的流量从离线网络中的特定IP地址传递到在线网络中的特定IP地址，这应该是完美的。|entityMap^0|0^^$0|@$1|2|3|4|5|6|7|E|8|@]|9|@]|A|$]]|$1|B|3|C|5|6|7|F|8|@]|9|@]|A|$]]]|D|$]]

I wouldn't exactly call them paranoid, and I applaud their attitude to security.

If they've gone to the trouble of separate networks, they've probably also gone to the trouble of installing a firewall. A small hole in the firewall which only allows traffic on port 25 to pass from a specific IP address in your offline network to a specific IP address in your online network should do the trick perfectly.

blocks|key|2115216|text|我将使用一个串行链接，只有GND和TX在安全服务器上，GNS和RX在不安全的网络上。没有流量控制，因为这可以用来将信息从不安全的网络泄漏到安全的网络。|type|unstyled|depth|inlineStyleRanges|entityRanges|data|2115217|我将创建一个小型SMTP-UDP-SMTP代理，它由2个守护进程组成。SMTP2UDP和UDP2SMTP.|2115218|SMTP2UDP将是一个不兼容的MTA，它将在安全网络上运行，并接受将使用UDP在串行链接上发送的电子邮件。|2115219|UDP2SMTP将在不安全的网络上运行，并通过UDP接收电子邮件，并将它们发送到真正的MTA。|2115220|在串行链路上，我会使用光耦合器来利用二极管的要求。|offset|length|entityMap|0|LINK|mutability|MUTABLE|url|http://en.wikipedia.org/wiki/Opto-isolator^0|0|0|0|0|B|4|0^^$0|@$1|2|3|4|5|6|7|S|8|@]|9|@]|A|$]]|$1|B|3|C|5|6|7|T|8|@]|9|@]|A|$]]|$1|D|3|E|5|6|7|U|8|@]|9|@]|A|$]]|$1|F|3|G|5|6|7|V|8|@]|9|@]|A|$]]|$1|H|3|I|5|6|7|W|8|@]|9|@$J|X|K|Y|1|Z]]|A|$]]]|L|$M|$5|N|O|P|A|$Q|R]]]]

I would use a serial link that has only the GND and TX on the secured server and GNS and RX on the unsecure network. No flow control as this can be used to leak information from unsecure network to the secured one.

I would create a small SMTP-UDP-SMTP proxy that is composed in 2 daemons. SMTP2UDP and UDP2SMTP.

SMTP2UDP will be a uncompliant MTA that will run on the secure network and accept emails that will send using UDP on the serial link.

UDP2SMTP will run on unsecure network and accept emails via UDP and send them to a real MTA.

On the serial link I would use an <a href="http://en.wikipedia.org/wiki/Opto-isolator" rel="nofollow noreferrer">optocoupler</a> to make use of the diode in the requirements.

blocks|key|4415501|text|如果您想实现这些要求，您可以使用单向IP链接，通过UDP+(或类似的单向协议)将其电子邮件发送到自定义守护进程，该守护进程监听这些数据包并通过SMTP发送给预期的收件人。|type|unstyled|depth|inlineStyleRanges|entityRanges|data|4415502|当然，发送(离线)系统将不知道他们是否真的出去了。为了实现这一确认，您需要一个最低限度的防火墙设置，就像Ben和Chopper3所回答的那样。|entityMap^0|0^^$0|@$1|2|3|4|5|6|7|E|8|@]|9|@]|A|$]]|$1|B|3|C|5|6|7|F|8|@]|9|@]|A|$]]]|D|$]]

If you wanted to implement the requirements to the letter, you could use a one-way IP link that sent its emails via UDP (or a similar unidirectional protocol) to a custom daemon that listened for these packets and sent them out via SMTP to the intended recipient.

Of course, the sending (offline) system would have no idea if they actually went out or not. For this acknowledgement to happen, you need a minimal firewall setup as Ben and Chopper3 have answered.

blocks|key|4415448|text|TCP协议需要双向通信.此设置听起来类似于DMZ设计，您的应用程序在受信任的intranet中运行，邮件服务器和/或收件人存在于不受信任的DMZ区域中。|type|unstyled|depth|inlineStyleRanges|entityRanges|offset|length|data|4415449|配置良好的防火墙只能允许从受信任的intranet启动连接，而不能允许从信任的intranet启动连接。如果这还不够，我怀疑这两个网络之间的任何物理连接将满足您的客户，这意味着您将无法自动发送邮件。|entityMap|0|LINK|mutability|MUTABLE|url|http://en.wikipedia.org/wiki/DMZ_%2528computing%2529^0|L|5|0|0^^$0|@$1|2|3|4|5|6|7|M|8|@]|9|@$A|N|B|O|1|P]]|C|$]]|$1|D|3|E|5|6|7|Q|8|@]|9|@]|C|$]]]|F|$G|$5|H|I|J|C|$K|L]]]]

The TCP protocol needs two-way communications. This setup sounds similar to a <a href="http://en.wikipedia.org/wiki/DMZ_%28computing%29" rel="nofollow noreferrer">DMZ design</a>, where your app runs in the trusted intranet, and the mailserver and/or recipients exist in the untrusted DMZ zone.

A well-configure firewall will be able to only permit connections to be initiated from the trusted intranet, and not the other way around. If that is not enough, I doubt any physical connection between the two networks will satisfy your client, which means you won't be able to send mail automatically.

blocks|key|4415561|text|如果他们已经到了这样的程度来分离网络，那么这里应该有两个防火墙，中间有一个启用邮件的盒子。在离线方面，只允许连接到此框通过自定义应用程序转储要发送的消息。在联机方面，只允许smtp连接到邮件服务器。|type|unstyled|depth|inlineStyleRanges|entityRanges|data|4415562|4415563|4415564|您可以通过在每个接口上运行软件防火墙的单一双主播框来实现同样的成本效益，但是将事情分开将创建几个额外的保护层，而且会更好。|entityMap^0|0|0|0^^$0|@$1|2|3|4|5|6|7|G|8|@]|9|@]|A|$]]|$1|B|3|-4|5|6|7|H|8|@]|9|@]|A|$]]|$1|C|3|-4|5|6|7|I|8|@]|9|@]|A|$]]|$1|D|3|E|5|6|7|J|8|@]|9|@]|A|$]]]|F|$]]

If they've gone to this extent to separate the networks, there should be two firewalls in place here with a mail-enabled box in the middle. On the offline side, only allow connections to this box to dump messages to send via your custom app. On the online side, only allow the smtp connection to the mail server. You could do the same very cost effectively with a single dual-homed box with software firewall running on each interface but having things separated out will create several additional layers of protection and would be preferable.

blocks|key|2115308|text|我只会有两个邮件服务器，一个内部的和一个外部的。让服务器不断地将传出的电子邮件附加到文件中，并且经常重命名该文件，将其复制到USB密钥上，并将其放在另一台服务器上的传入文件夹中。这是多少个安装在网络服务器中执行空隙。|type|unstyled|depth|inlineStyleRanges|entityRanges|data|2115309|如果它太重要，不能延迟，它可以从外部客户发送。|entityMap^0|0^^$0|@$1|2|3|4|5|6|7|E|8|@]|9|@]|A|$]]|$1|B|3|C|5|6|7|F|8|@]|9|@]|A|$]]]|D|$]]

I would just have two mail servers, an internal and an external. Have the servers continually append outgoing emails to a file, and every so often rename the file, copy it on a USB key, and drop it in an incoming folder on the other server. This is how many installations perform air gaps in network servers.

If it's too important to delay, it can be sent from one of the outside clients.

I have a very paranoid client who runs two separate networks (one offline, one online) with separate PCs etc.

I have a challenge in that I have written an application for them that will run on the offline network however the network needs to be able to send emails to clients. My idea is to have a one way network connection (like a diode) from the offline server to an online PC that would send the emails.

What is the most effective way to go about this that is semi cost effective? Can I get a one way network card?

Windows Server 2008 Network, Windows PC.

One Way Network Connection

翻译质量差，导致语言生硬或混乱。

没有提供实际的解决方法或示例。

解答不清晰，无法理解或解决问题。

页面排版不美观，阅读体验差。

文章

问答

视频

教程

学习中心

腾讯云实验室

直播

竞赛

腾讯云代码分析专区

腾讯iOA零信任安全管理系统专区

腾讯云架构师技术同盟交流圈

腾讯云数据库专区

腾讯云智能顾问专区

腾讯云原生专区

腾讯混元专区

腾讯云TCE专区

腾讯云Lighthouse专区

腾讯云HAI专区

腾讯云Edgeone专区

腾讯云存储专区

腾讯云智能专区

腾讯轻联专区 

腾讯云开发专区

TAPD专区

腾讯轻量云游戏服专区

腾讯云最具价值专家

腾讯云架构师技术同盟

腾讯云创作之星

腾讯云开发者先锋

腾讯云AI代码助手

云原生构建

TAPD 敏捷项目管理

Cloud Studio

SDK中心

API中心

命令行工具

功能1上新10个字符

功能2描述100个字符功能2描述100个字符功能2描述100个字符功能2描述100个字符功能2描述100个字符功能2描述100个字符功能2描述100个字符功能2描述100个字符功能2描述100个字符。

功能2上新100个字符功能2上新100个字符功能2上新100个字符功能2上新100个字符功能2上新100个字符功能2上新100个字符功能2上新100个字符功能2上新100个字符功能2上新100个字符。

功能5描述100个字符功能5描述100个字符功能5描述100个字符功能5描述100个字符功能5描述100个字符功能5描述100个字符

功能5上新100个字符功能5上新100个字符功能5上新100个字符功能5上新100个字符功能5上新100个字符功能5上新100个字符功能5上新100个字符功能5上新100个字符功能5上新100个字符功能5上新100个字符

功能4上新

文章&问答评论现已支持表情

全新交互，全新视觉，新增快捷键、悬浮工具栏、高亮块等功能并同时优化现有功能，全面提升创作效率和体验

社区富文本编辑器全新改版！诚邀体验～ 

精选全网热门MCP server，让你的AI更好用 🚀

💥开发者 MCP广场重磅上线！

涵盖代码开发、场景应用、自动测试全流程，助你从零构建专属AI助手

一站式MCP教程库，解锁AI应用新玩法

聚焦“写作效率、视觉美观与运行性能”三方面进行全面升级，为您提供更高效、稳定的创作环境

社区富文本&Markdown编辑器全新改版上线，欢迎大家体验!

诚挚邀请您参与本次调研，分享您的真实使用感受与建议。您的反馈至关重要，感谢您的支持与参与！

社区新版编辑器体验调研

我有一个非常偏执的客户，他运行两个不同的网络(一个离线，一个在线)与不同的个人电脑等。我有一个挑战，因为我已经为他们编写了一个应用程序，它将在离线网络上运行，但是网络需要能够向客户发送电子邮件。我的想法是有一个单向的网络连接(如二极管)从离线服务器到在线个人电脑发送电子邮件。什么是最有效的方式去做这是半成本效益？能给我一张单程网卡吗？Windows 2008网络，Windows。

问单向网络连接
EN

回答 7

Server Fault用户

Server Fault用户

Server Fault用户

社区

活动

圈层

关于

腾讯云开发者

热门产品

热门推荐

更多推荐

问单向网络连接EN

回答 7

Server Fault用户

Server Fault用户

Server Fault用户

社区

活动

圈层

关于

腾讯云开发者

热门产品

热门推荐

更多推荐

问单向网络连接
EN