l i n u x - u s e r s - g r o u p - o f - d a v i s
L U G O D
 
Next Meeting:
August 5: Social gathering
Next Installfest:
TBD
Latest News:
Jul. 4: July, August and September: Security, Photography and Programming for Kids
Page last updated:
2001 Dec 30 16:59

The following is an archive of a post made to our 'vox-tech mailing list' by one of its subscribers.

Report this post as spam:

(Enter your email address)
Re: [vox-tech] dsl ideas
[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

Re: [vox-tech] dsl ideas



On Sun, 3 Dec 2000, Gabriel Rosa wrote:

> On Sun, 3 Dec 2000, Ted Deppner wrote:

[...]

> > > would simply connect to the other vlan on the switch (however many ports for
> > > internal use) and the other machines would all be there.
> > 
> > Routers route... you don't want it to "bridge".  I'll assuming you
> > misspoke.
> 
> Right, I'm refering to the fact that traffic from the outside would be routed
> to the internal network and vice-versa :) my mistake. Bridging would imply 2
> separate media, iirc.

not necessarily... bridging can be setup between similar media...

> > It would work, and many people do it that way... however, if you want
> > protection from that nasty DSL line and all the internet, you may consider
> > putting the DSL into your router directly on it's own NIC (with a
> > crossover type cable), then your two lans (public server lan and private
> > MASQuerade/NAT LAN) each on their own NIC for increased security.  This
> > would be a total of three NICs in your router.
> > 
> 
> This seems too cumbersome, imho. And i'd hate to have my whole network
> go down just because my router died.

hmm... what if your switch or adsl modem dies?  Truly redundant networking
involves different connectivity arrangements than your typical 5 ip dsl
connection.  Quick swapout is much more practical.

> One of my ideas is to have a second router as a backup (our primary router
> does http, ftp and some other stuff) just to do nat, and maybe have the
> clients switch routers after some timeout. Just an idea :P

The canonical firewall arrangement includes an external firewall connected
to a DMZ (demilitarized zone) which includes public servers and a second
firewall for your local network clients. The primary firewall has holes to
allow services to work, and the secondary firewall ONLY allows connections
from the clients outward.

Note that in your case, to support real ip addresses with a primary
firewall you would have to use proxy arp to simulate bridging while
allowing firewalling or use the bridging firewall patch.  
(http://linuxdoc.org/HOWTO/mini/Bridge+Firewall+DSL-2.html or
http://lrp.c0wz.com/dox/pa.txt)

However, Ted's suggestion is quite common... see lrp.steinkuehler.net...  
Charles uses 1-1 nat for the servers in the DMZ (in one configuration) and
a third nic for the local network.

---------------------------------------------------------------------------
Jeff Newmiller                        The     .....       .....  Go Live...
DCN:<jdnewmil@dcn.davis.ca.us>        Basics: ##.#.       ##.#.  Live Go...
Work:<JeffN@endecon.com>              Live:   OO#.. Dead: OO#..  Playing
Research Engineer (Solar/Batteries            O.O#.       #.O#.  with
/Software/Embedded Controllers)               .OO#.       .OO#.  rocks...2k
---------------------------------------------------------------------------


LinkedIn
LUGOD Group on LinkedIn
Sign up for LUGOD event announcements
Your email address:
facebook
LUGOD Group on Facebook
'Like' LUGOD on Facebook:

Hosting provided by:
Sunset Systems
Sunset Systems offers preconfigured Linux systems, remote system administration and custom software development.

LUGOD: Linux Users' Group of Davis
PO Box 2082, Davis, CA 95617
Contact Us

LUGOD is a 501(c)7 non-profit organization
based in Davis, California
and serving the Sacramento area.
"Linux" is a trademark of Linus Torvalds.

Sponsored in part by:
EDGE Tech Corp.
For donating some give-aways for our meetings.