1 |
On 7/18/06, Ian P. Christian <pookey@×××××××××.uk> wrote: |
2 |
> On 07/18/06 Drew wrote: |
3 |
> > Multiple physical interfaces isolate the underlying ethernet traffic |
4 |
> > to the specific 'side' of the firewall they're attached to. On a |
5 |
> > single wire/NIC setup all you need is a packet sniffer running on a |
6 |
> > 'outside' malicious host (in promiscuous mode) to map the firewalled |
7 |
> > portion of your network and then configure the same host to masquerade |
8 |
> > as a firewalled host. Once that's done, the malicious host has the |
9 |
> > same access rights as any other firewalled host. |
10 |
> |
11 |
> You're failing to think of point to point tunnels links over a secure |
12 |
> protocol, and VLANS - but your point is correct if on a standard flat |
13 |
> network. |
14 |
|
15 |
Agreed. Those do work but I would classify those as special cases that |
16 |
need certain hardware/software to work properly. |
17 |
|
18 |
I'd still classify VLANs under the flat network though. If the VLAN is |
19 |
setup under Linux using aliases it still suffers from the single wire |
20 |
problem. The only VLAN setup I've seen that doesn't have this problem |
21 |
is using a switch that supports VLAN at the hardware level. The catch |
22 |
is you need a interface/wire for each VLAN the machine is attached to. |
23 |
True switches (as opposed to routers or hybrids) don't do the IP level |
24 |
packet inspection needed to direct ethernet traffic from a single port |
25 |
(on the switch) to the correct VLAN. |
26 |
|
27 |
|
28 |
-Drew |
29 |
-- |
30 |
gentoo-server@g.o mailing list |