Re: [gentoo-server] Cheap Gentoo firewall hardware

[Drew]

On 7/18/06, Ian P. Christian <pookey@×××××××××.uk> wrote:
> On 07/18/06 Drew wrote:
> > Multiple physical interfaces isolate the underlying ethernet traffic
> > to the specific 'side' of the firewall they're attached to. On a
> > single wire/NIC setup all you need is a packet sniffer running on a
> > 'outside' malicious host (in promiscuous mode) to map the firewalled
> > portion of your network and then configure the same host to masquerade
> > as a firewalled host. Once that's done, the malicious host has the
> > same access rights as any other firewalled host.
>
> You're failing to think of point to point tunnels links over a secure
> protocol, and VLANS - but your point is correct if on a standard flat
> network.

Agreed. Those do work but I would classify those as special cases that
need certain hardware/software to work properly.

I'd still classify VLANs under the flat network though. If the VLAN is
setup under Linux using aliases it still suffers from the single wire
problem. The only VLAN setup I've seen that doesn't have this problem
is using a switch that supports VLAN at the hardware level. The catch
is you need a interface/wire for each VLAN the machine is attached to.
True switches (as opposed to routers or hybrids) don't do the IP level
packet inspection needed to direct ethernet traffic from a single port
(on the switch) to the correct VLAN.


-Drew
-- 
gentoo-server@g.o mailing list