Re: 3 nics - 1 bridge - 2 ips - bad?

From: Eric Anderson (anderson@centtech.com)
Date: 06/27/01 

Date: Wed, 27 Jun 2001 12:28:09 -0500
From: Eric Anderson <anderson@centtech.com>
To: Joseph Gleason <freebsd@fireduck.com>

Thanks for the response.. I think you're correct here, I don't see
anyway to only enable 2 out of 3 interfaces for bridging. Darn. Oh
well, thanks!

Joseph Gleason wrote:
>
> I think you might have a problem with the bridging.
>
> I'm not sure if you can bridge xl0 and xl1 without including xl2. I could
> be wrong
> And you might be able to pull something off with IPFW rules to exclude xl2
> from the bridging, but I wouldn't trust it.
>
> What you want certainly looks like two separate and possibly incompatible
> tasks. My advise would be have two machines do this if at all possible.
> Machine one being your ethernet bridge. Machine two being the gateway to
> your protected network.
>
> ----- Original Message -----
> From: "Eric Anderson" <anderson@centtech.com>
> To: <freebsd-security@FreeBSD.ORG>
> Sent: Wednesday, June 27, 2001 12:46
> Subject: 3 nics - 1 bridge - 2 ips - bad?
>
> > Lets say I have 3 NIC's in a machine running FreeBSD 4.2.
> > Is it possible to have this sort of configuration:
> > xl0 - 200.200.200.200 - [interface 1 of bridge0]
> > xl1 - NO IP - [interface 2 of bridge0]
> > xl2 - 192.168.10.10 - not part of any bridge
> >
> > the 200.200.200.200 number is of course made up, but signifies an
> > interface on the unprotected net. The 192.168.10.10 interface is also
> > made up, showing an interface on the protected internal net. Now, the
> > xl1 interface is bridged to xl0, creating a port for passing thru to the
> > unprotected net that xl0 is on. Is there any inherent security flaws in
> > this configuration (besides having a possible computer plug into the xl1
> > port and not being behind a firewall), assuming it works at all?
> >
> > Thanks in advance..
> >
> > Eric
> >
> >
> >
> > --
> > --------------------------------------------------------------------------
> -----
> > Eric Anderson anderson@centtech.com Centaur Technology (512)
> > 418-5792
> > For every complex problem, there is a solution that is simple, neat, and
> > wrong.
> > --------------------------------------------------------------------------
> -----
> >
> > To Unsubscribe: send mail to majordomo@FreeBSD.org
> > with "unsubscribe freebsd-security" in the body of the message
> > 

-- 
-------------------------------------------------------------------------------
Eric Anderson	 anderson@centtech.com    Centaur Technology    (512)
418-5792
For every complex problem, there is a solution that is simple, neat, and
wrong.
-------------------------------------------------------------------------------
To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-security" in the body of the message

Relevant Pages

  • RE: 4.7 vs 5.2.1 SMP/UP bridging performance
    ... >>on might give a significant performance boost for bridging. ... >multiple CPUs. ... Either lock an interface to a thread, ...
    (freebsd-current)
  • RE: 4.7 vs 5.2.1 SMP/UP bridging performance
    ... >>on might give a significant performance boost for bridging. ... >each thread poll every interface, or only an exclusive subset of the ... >be addressed first (assuming that is the current bottleneck for SMP) ...
    (freebsd-current)
  • Re: wireless-to-wired bridging
    ... Well, yes, that's what bridging means. ... > another wireless client, it must be first sent to the wireless interface ... which should theoretically redirect the packet to ...
    (freebsd-questions)
  • Re: 3 nics - 1 bridge - 2 ips - bad?
    ... I think you might have a problem with the bridging. ... Machine one being your ethernet bridge. ... > interface on the unprotected net. ...
    (FreeBSD-Security)
  • fbsd briding && routing
    ... is making three ot them (xl0, xl1, xl2) part of a bridging cluster, and the ... is using the box as an integrated routing and bridging mashine. ... All the machines have 192.168.1/24 addreses, as I want to see each other ... always points to xl1 interface. ...
    (freebsd-net)