From owner-freebsd-net@FreeBSD.ORG Fri Sep 3 10:53:42 2004 Return-Path: Delivered-To: freebsd-net@freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id 4875516A4CE for ; Fri, 3 Sep 2004 10:53:42 +0000 (GMT) Received: from fritz.delphinium.net (pcp487354pcs.howard01.md.comcast.net [68.55.21.183]) by mx1.FreeBSD.org (Postfix) with ESMTP id D438943D2D for ; Fri, 3 Sep 2004 10:53:41 +0000 (GMT) (envelope-from rtoren@bronzedragon.net) Message-ID: <41384D4C.9030209@bronzedragon.net> Date: Fri, 03 Sep 2004 06:54:04 -0400 From: RRrp Toren User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.7.1) Gecko/20040707 X-Accept-Language: en-us, en MIME-Version: 1.0 To: Charles Swiger References: <413763C1.90208@bronzedragon.net> <1B4160E2-FD0E-11D8-A54A-003065A20588@mac.com> In-Reply-To: <1B4160E2-FD0E-11D8-A54A-003065A20588@mac.com> Content-Type: text/plain; charset=us-ascii; format=flowed Content-Transfer-Encoding: 7bit cc: freebsd-net@freebsd.org Subject: Re: 3 NICs - 1 upstream, 2 downstream to same subnet?? X-BeenThere: freebsd-net@freebsd.org X-Mailman-Version: 2.1.1 Precedence: list List-Id: Networking and TCP/IP with FreeBSD List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 03 Sep 2004 10:53:42 -0000 Charles Swiger wrote: > On Sep 2, 2004, at 2:17 PM, rip wrote: > >> I am trying to make a configuration to isolate the WiFi APs on a >> single segment. DHCP hands out 'good' addresses (10.0.0.x) to MACs it >> recognizes and 'bad' (10.99.0.x) when the MAC does not match and is >> taken from the common pool. >> I then will use ipfw to block the trespassers, but do a bit of data >> collection at the same time. I don't expect much bad traffic here >> since WEP will keep out the casual. Just a defense-in-depth thing. > > > What you're trying to do work actually give you much benefit to > security: someone who wants to break in doesn't have to pay attention to > the DHCP lease you give them, they can just assign themselves a good > 10.0.0.x address. I am not a believer in the idea that the only good solution is the 100% solution. I like the multi-layering of 80% solutions. The IP addresses here were picked for demonstration purposes. The actuals set can come from anywhere within the RFC 1918 network numbers. So picking a good IP the 1st time, in the blind, is like shooting a bullseye on the first shot in a pitchblack range you just stepped into. Then there are other layers that have to be bypassed. Sort of like Indiana Jones. There are many challenges to overcome, with only one attempt each. I am just asking about the technical feasability. > > The second problem you are having is that you can't have two NIC on the > same subnet. The routing table needs interfaces to be unique so it > doesn't have to guess which route should be used. > If this is a FreeBSD implementation restriction, then so be it. I have always thought routers could service a large subnet with multiple interfaces. And that FreeBSD could be configured as a router. Thanks for the info Rip