/* HINT: Search archives @ http://www.indyramp.com/masq/ before posting! */
Good evening, Randy,
On Tue, 21 Dec 1999, Randy Perry wrote:
> This is probably a dumb question, but does it make any sense to use a
They don't exist. I'm glad you asked.
> computer with a single ethernet interface as a masq/firewall machine for a
> LAN using a cable modem?
>
> Seems like it probably wouldn't as all incoming traffic would go to every
> machine on the LAN -- unless a switch was used.
Good point. By issue:
- Will it work at all? Actually, it will. Give the masq box the
public IP on the nic and assign the private IP to eth0:1 :
ifconfig eth0:1 172.16.0.1 netmask 255.255.0.0 broadcast 172.16.255.255 up
route add -net 172.16.0.0 netmask 255.255.0.0 dev eth0:1
if [ -f /proc/net/ip_fwchains ]; then
/sbin/ipchains -A forward -s 172.16.0.0/16 -j MASQ
elif [ -f /proc/net/ip_input ]; then
/sbin/ipfwadm -F -a accept -m -S 172.16.0.0/16
fi
While we normally think of an Ethernet segment as carrying the
traffic for a single IP network, in fact there's nothing in the IP or
Ethernet spec that says you can't have two or more IP networks on a single
Ethernet segment. The traffic mixes quite well.
Be prepared for a _whole_ lotta fun in figuring out any additional
rules.
- Reducing traffic on the lan. You're correct; using a switch or
a masq box with two nics would cut down the traffic on a single Ethernet
segment, reducing collisions and also increasing the carrying capacity of
the segment.
- Cost: You save the cost of an Ethernet card. Maybe $20-$50?
It's not necessary to use a hub between the masq box and the cable modem;
depending on the model of cable modem you have, a regular Ethernet or
crossover Ethernet cable plugged into the masq box and the cable modem
will do quite nicely.
- Security. By mixing the traffic between your protected IP
network and the outside world, you reduce the level of security quite
dramatically. Now someone who gets access to a device on the real side of
the masq box can sniff traffic carried over the private network
immediately.
On a cable network, this can be a big deal; depending on the
configuration of the cable network, you may be sharing all your packets
with everyone in your neighborhood. Including your plaintext logins and
passwords and any drive shares you have.
Ugh.
But there's one more detail that probably is more important than
all the above. If your cable ISP has sold you a service that only works
with one machine, their cable modem unit may be programmed to only talk to
the first mac address it sees at boot time. By placing your client
workstations, the sole nic for the masq box and the cable modem itself on
the same physical Ethernet segment, your cable service may latch onto one
of the client workstations and refuse to talk to the masq box.
In short, unless you have severe financial or hardware
limitations, it's probably worth it to spring for the second Ethernet
card.
Cheers,
- Bill
---------------------------------------------------------------------------
Windows 2000 installed without a hitch, but the process takes so long
that InfoWorld Senior Analyst Maggie Biggs and I are debating over the
best 10 things you can do while you wait. One of her thoughts is to run
a marathon. And not finish first.
I'll have to fall back on one of my favorites: spit shining the Empire
State Building.
- Courtesy of Nicholas Petreley, Infoworld
--------------------------------------------------------------------------
William Stearns ([EMAIL PROTECTED]). Mason, Buildkernel, named2hosts,
and ipfwadm2ipchains are at: http://www.pobox.com/~wstearns/
--------------------------------------------------------------------------
_______________________________________________
Masq maillist - [EMAIL PROTECTED]
Admin requests can be handled at http://www.indyramp.com/masq-list/ -- THIS INCLUDES
UNSUBSCRIBING!
or email to [EMAIL PROTECTED]
PLEASE read the HOWTO and search the archives before posting.
You can start your search at http://www.indyramp.com/masq/
Please keep general linux/unix/pc/internet questions off the list.
