Re: LAN access while VPN is up

From: Triffid (triffid_at_nebula.net)
Date: 11/01/05

  • Next message: telicalbook: "Re: How can I make sure I use Zonealarm not Microsoft firewall" 
    Date: Mon, 31 Oct 2005 21:55:41 -0500

    Moe Trin wrote:
    > In the Usenet newsgroup comp.security.firewalls, in article
    > <68f9f.1790$J14.80418@news20.bellglobal.com>, Triffid wrote:
    >
    >
    >>I've forgotten my reason - no doubt it was bizarre.
    >
    >
    > The two most common reasons for choosing the "Class A" range of RFC1918
    > are: 1) it's the first one listed in the tables of such addresses; and
    > 2) people think it's impressive - forgetting that the address doesn't
    > appear on the Internet, and no one else is going to know you are using it.

    More likely down to my habit of changing default settings - most home
    networking gear comes out of the box set to 192.168.x.x, like the NAT
    router I was using before deciding to invest in a firewall. Not that I
    have any faith in security by obscurity, but a lot of poorly coded
    malware falls over if the system isn't bog-standard (especially in the
    windoze world). This is not the first time I've been bitten - legitimate
    software has been known to fall over because I didn't install windoze
    where it is 'supposed' to be...

    >>The tunnel runs from my laptop to my employer's VPN switch. The intent
    >>of the client configuration enforced by the switch is to prevent my
    >>laptop having simultaneous access to the corporate intranet and public
    >>internet.
    >
    >
    > That's done with procedure/policy here. The system I have to connect to
    > the company net has one network interface - to that net only. My home
    > systems are on a different net, physically isolated from the company
    > computer - the classic "air gap". I can also get in to the company
    > net via SSH over the Internet, but the number of hoops to jump through
    > makes using the company box preferable. Yes, that means two data links
    > in the house.

    No such luxury here. I could create separate networks that only touch at
    the Netscreen. However, it's a low-end model, so that involves switching
    it to 'home/work mode' - which wipes the config so I get to start over :-(

    >>The VPN client on my laptop routes everything except 192.168.0.0/16 up
    >>the tunnel, and disconnects the tunnel if I mess with the routing table.
    >>Since my local LAN isn't 192.168.x.x, it's unreachable while the tunnel
    >>is up.
    >
    >
    > Got it. I've got a minor advantage that I have 'root' (admin user) on
    > all systems here, including the company box, which would allow me to
    > do a lot of things. The company box has a non-routable address (they
    > see no reason why I need a real address), and if I'm really desperate
    > to reach the Internet without using my own systems, I can SSH into a
    > system at work, and reach out from there.

    On the odd occasion I need to reach the Internet while working, I can
    use the corporate gateway via the tunnel. What I can't do is get
    hardcopy on a local printer, or grab something off the local file server
    - at least not without dropping the tunnel.

    Unless there's a trick that hasn't occurred to me (hence my original
    post), my choices are:

    1. Renumber the local network to 192.168.x.x
    2. Use the Netscreen to create a second local network
    3. Use one of the spare routers to create a second local network
    4. Status Quo

    Only 2 and 4 make sense to me. 1 is almost as painful as 2, but doesn't
    segregate home/work. 3 uses more electricity but provides weaker
    segregation than 2. 4 is tolerable but not ideal.

    Triffid

  • Next message: telicalbook: "Re: How can I make sure I use Zonealarm not Microsoft firewall"

    Relevant Pages

    • Re: How do I change the port for remote desktop in win2003?
      ... >>It's not really a dual lan, it's a NIC on WAN and a NIC on ... >>local network. ... >>It's still a bad idea to put Windows 2003 server directly on the Internet. ... even NAT is better than a direct connection. ...
      (comp.security.firewalls)
    • Re: How do you make your life secure (software based)?
      ... care very much about these things in my local network, ... If you want your life to be secure, buy lots of guns and live in a cave. ... If you want your internet existence to be totally secure: ... To UNSUBSCRIBE, email to debian-user-REQUEST@xxxxxxxxxxxxxxxx ...
      (Debian-User)
    • Re: Numpty VPN questions
      ... What kind of tunnel are we talking about and what do you need to do ... VPN tunnels are bi-directional. ... your Internet traffic is routed through your BB router as normal. ... monopoly is successfully blocking voip services like Skype. ...
      (uk.comp.sys.mac)
    • Re: Can not see my own websites after setting up routing
      ... If I understand your post correctly, you have a DNS issue. ... Networking, Internet, Routing, VPN Troubleshooting on ... I have setup counting on Machine1. ... I have websites setup on Machine2 on my local network and am routing all ...
      (microsoft.public.win2000.ras_routing)
    • Dial-in server problem: no routing
      ... I have server connected to local network with internet access. ... properties of connection used for internet: ...
      (microsoft.public.windows.server.networking)