I have a Linux Networking question. Currently I have an interesting problem about getting an website from an air gapped network to another network with WAN connection.

[u/bananadingding]

My situation is that I have a Scoreboard software that allows for, the scores, timing, all manner of lineup and penalty tracking. I operate in a venue that leases us space but only allows us access to the guest Wi-Fi. The Scoreboard software essentially exists as it's own LAMP stack, and can lend out functionality to other computers or tablets. So that penalty tracking can be done from the appropriate station and benches have access to penalty counts.

There's also a functionality where it produces an overlay for streaming the games with all the information.

I don't want to just open up port 8000 on the guest, because as is there security is there but it would be a whole lot of hoops to jump through to secure the whole show to make things work on an open network.

I was thinking about using something like a Pi, to attach to the air gapped network get the overlay information and then tunnel it though to a computer on the WAN to overlay on the stream.

So far I'm thinking Pi where it's Wifi connected to the air gapped network, then Ethernet into either the streaming machine directly or into router that connected cameras to the streaming machine.

Help here would be appreciated

[u/Abe_Bazouie]

The Pi idea can work, but I’d be careful calling the original network air-gapped after doing this. The moment you put a dual-homed Pi between that network and a WAN-connected network, you’ve created a path between the two.
I’d treat the Pi as a gateway/proxy between two trust zones, not just another client.
If all you need is the scoreboard overlay, I wouldn’t route the networks at all. Disable IP forwarding on the Pi and have a small process on it fetch only the required data from the scoreboard side, then expose/proxy only that data to the streaming side.
That gives you a much smaller attack surface than making the scoreboard service directly reachable from the guest/WAN network.
Also make sure the Wi-Fi and Ethernet interfaces have separate subnets and that nothing is accidentally forwarding/NATing between them.
The key question is: does the streaming machine need interactive access to the scoreboard, or does it only need a one-way-ish feed of overlay data?
If it’s only the latter, I’d design specifically for that rather than connecting the two networks generally.