Messages in this thread | | | From | (david parsons) | Subject | Re: eth-Devices and naming wishes | Date | 8 Mar 1999 19:03:44 -0800 |
| |
In article <linux.kernel.E10Jk4K-0008JN-00.1999-03-07-21-22-36@torres.gf1.internal>, Marc Haber <Marc.Haber-usenet@gmx.de> wrote: >Hi! > >I am building a firewall system based on Linux. My machine has two >ne2k-pci-network cards, one of them being destined to be connected to >the untrusted network. The drivers will be loaded as kernel modules. > >I am thinking about doing the following: >- The trusted card will have its slot shield painted green; its MAC > address will be known. >- When the system boots, the ethernet drivers will be loaded and the > interface that has the known MAC address of the will be marked in > the system configuration as being connected to the trusted network. > >However, it seems that I can't control which ethx alias will be >associated with the trusted network because both cards are PCI and >their resource assignments are controlled by the system BIOS. Thus, I >will have to jump through hoops to take care of this in every init and >maintenance script which will prove a major pain and source of >problems.
If you want to be clever, you can do what I did when I did the WebShield project for McAfee Associates; if you have a trusted host inside the firewall, you can have the firewall bring up one interface at a time and ping for that machine. The interface that gets a reply is the inside interface, and you can go on from there.
I didn't use eth0 or eth1 for either interface. I defined, in a configuration file somewhere, INTERNAL_IF and EXTERNAL_IF, which were set by the initialization script that did the pinging (also useful if either of the interfaces is going to be a token-ring or arcnet interface...)
____ david parsons \bi/ And this is all done in userspace, so you can avoid \/ some of the vagaries of the kernel.
- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.rutgers.edu Please read the FAQ at http://www.tux.org/lkml/
| |