[lkml]   [1999]   [Apr]   [14]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
Messages in this thread
SubjectRe: 2.2.5 kernel/routing/firewalling
>What you are talking about is a bridge. However, most firewall
>configurations act as a gateway.

I thought I probably was, thats why I looked at the 'Bridging' mini-howto
but I couldnt see whether it was possible or not to make it do
filtering/firewalling without having to make it the default router
as well. Its starting to look as though I cant, although one suggestion
so far is to use rarp. This may cause me some headaches - I have
800+ machines on my local side, and a huge number on the campus
side, although admittedly I dont need to know about most of them,
just mail hubs, web servers, news servers, time servers and dns servers.


>Why? Bridges generally are only worried about network packets, in this
>case ethernet. It sees a packet on one side, determines that the recipient
>may be on the other side, and retransmits the packet on that side. It
>doesn't care if it is IP or IPX or SMB or whatever. It's taking care of
>ethernet packets.
>Firewalls, on the other hand, look at IP packets, deterines whether it
>should pass the packet based on the source/destination addresses, and on
>the port and protocol numbers, and then either passes it on (generally
>with some rewriting of the IP headers) or drops it. Much more work
>intensive and needs much more information than just the eternet headers.
>So, you really should/have to use your firewall as a gateway device. Doing
>it as a bridge will leak packets both ways, and won't give you much in the
>way of security.
>There are some 'transparent' security devices out there, but IMHO, they

To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to
Please read the FAQ at

 \ /
  Last update: 2005-03-22 13:51    [W:0.051 / U:0.340 seconds]
©2003-2017 Jasper Spaans. hosted at Digital OceanAdvertise on this site