Network protection device and method for internal flow control via switch ARP modulation and access lists

A network protection device, comprising:

• a communication device;
• a storage device configured to store a white list that defines access rights between a plurality of first terminals belonging to a target network;
• and
• a control device configured to modulate an address resolution protocol (ARP) table of each of the plurality of first terminals using an ARP packet so that a first communication flow generated between the plurality of first terminals is received by the communication device, and block the first communication flow or transmit the first communication flow to a destination based on the white list when the first communication flow is received,
• wherein the control device is further configured to:
• modulate the ARP table of each of the plurality of first terminals using an ARP packet so that a second communication flow transmitted from any one of the plurality of first terminals to an external network is received by the communication device;
• store domain name system (DNS) information of a DNS response packet in a DNS table when the DNS response packet is received from the external network;
• and
• block the second communication flow without transmitting the second communication flow to a destination when it is determined that the second communication flow is a communication flow generated without a DNS query by referring to the DNS table, and
• wherein the DNS information includes an IP address and a domain address included in the DNS response packet.