🚀 go-pugleaf

H J Lu wrote:
> 
> 
> 1. From our class C network, all outgoing connections can be
>    allowed/denied bases on the IP addresses/ports.
> 2. From outside, all incoming connections should go through the
>    firewall and we can control the access. If necessary, we can allow
>    any incoming connections based on the IP addresses/ports.
> 3. We plan to run a few Internet servers on the firewall machine which
>    are accessible from the outside.
> 4. To access our Class C network from the outside, we should be able to
>    login on the firewall machine and go from there.
> 

>From what I found, I came up such a configuration:

1. A 486 PC running Linux with an ethernet card.
2. A Combinet EVERYWARE 1000 Card.
3. IPfirewall software.

I think that should be all I need. One thing I am not sure is how
hard to set up the Combinet EVERYWARE 1000 Card to run PPP over it.
BTW, We will have an ISDN Centrex with 2 B-channels. Is there
anything I should know about my choices?

Thanks.

H.J.

In article <4dgk7n$qj6@aurora.romoidoy.com>, hjl@zoom.com (H J Lu) writes...
>H J Lu wrote:
>> 
>> 
>> 1. From our class C network, all outgoing connections can be
>>    allowed/denied bases on the IP addresses/ports.
>> 2. From outside, all incoming connections should go through the
>>    firewall and we can control the access. If necessary, we can allow
>>    any incoming connections based on the IP addresses/ports.
>> 3. We plan to run a few Internet servers on the firewall machine which
>>    are accessible from the outside.
>> 4. To access our Class C network from the outside, we should be able to
>>    login on the firewall machine and go from there.
>> 
> 
>>From what I found, I came up such a configuration:
> 
>1. A 486 PC running Linux with an ethernet card.
>2. A Combinet EVERYWARE 1000 Card.
>3. IPfirewall software.
> 
>I think that should be all I need. One thing I am not sure is how
>hard to set up the Combinet EVERYWARE 1000 Card to run PPP over it.
>BTW, We will have an ISDN Centrex with 2 B-channels. Is there
>anything I should know about my choices?

If you have an Ethernet card, why would you get an ISDN card? The best thing to
do would be to get an external ISDN router. Call your ISP and see what kind of
ISDN router they have. Since 80% of ISP's use Ascend, it would be best to get
an Ascend router. It comes with a cable to plug into your Ethernet card or hub
if you have other hosts.

In article <4dgk7n$qj6@aurora.romoidoy.com> hjl@zoom.com (H J Lu) writes:

   From: hjl@zoom.com (H J Lu)
   Newsgroups: comp.os.linux.networking,comp.security.firewalls,comp.dcom.isdn,comp.os.linux.hardware
   Date: 16 Jan 1996 08:37:11 -0800
   Organization: Zoom.Com Information Services Inc.
   Followup-To: comp.os.linux.networking,comp.security.firewalls,comp.dcom.isdn,comp.os.linux.hardware
   Path: canyon.sr.hp.com!col.hp.com!csn!ub!news.kei.com!uhog.mit.edu!news.mathworks.com!newsfeed.internetmci.com!in2.uu.net!wizard.pn.com!news.zeitgeist.net!news.zoom.com!news.zoom.com!not-for-mail
   Lines: 28
   References: <4deaub$nll@aurora.romoidoy.com>
   NNTP-Posting-Host: aurora.zoom.com
   X-Newsreader: TIN [version 1.2 PL2]
   Xref: canyon.sr.hp.com comp.os.linux.networking:31406 comp.security.firewalls:1722 comp.dcom.isdn:30814 comp.os.linux.hardware:33614

   H J Lu wrote:
   > 
   > 
   > 1. From our class C network, all outgoing connections can be
   >    allowed/denied bases on the IP addresses/ports.
   > 2. From outside, all incoming connections should go through the
   >    firewall and we can control the access. If necessary, we can allow
   >    any incoming connections based on the IP addresses/ports.
   > 3. We plan to run a few Internet servers on the firewall machine which
   >    are accessible from the outside.
   > 4. To access our Class C network from the outside, we should be able to
   >    login on the firewall machine and go from there.
   > 

   >From what I found, I came up such a configuration:

   1. A 486 PC running Linux with an ethernet card.
   2. A Combinet EVERYWARE 1000 Card.
   3. IPfirewall software.

   I think that should be all I need. One thing I am not sure is how
   hard to set up the Combinet EVERYWARE 1000 Card to run PPP over it.
   BTW, We will have an ISDN Centrex with 2 B-channels. Is there
   anything I should know about my choices?

   Thanks.

   H.J.


I Just did this for our Elementary School. First off ... be VERY careful
with that Combinet card. Don't get it unless your ISP _guarantees_ it'll
work that way you want (which implies Combinet hardware at the ISP).

Take a look in http://whited.rvusd.k12.ca.us/technical for a view of
our installation.


  Mike Ferrara M/S 4USS
  HP Microwave Instruments Div R&D
  1400 Fountain Grove Pkwy
  Santa Rosa, CA 95403-1799
  (707) 577-4479
  mikef@sr.hp.com

PGP Key Fingerprint = EC F3 52 79 9C 00 0F 78  00 38 28 CC 72 3C 2D 1C

hjl@zoom.com (H J Lu) wrote:

>Hi,
>
>I am put in charge to design/implement a firewall for our class C 
>network with an ISDN connection to internet. Our goal is to control the
>access from the outside and yet provide the maximum transparency.
>
>1. From our class C network, all outgoing connections can be
>   allowed/denied bases on the IP addresses/ports.
>2. From outside, all incoming connections should go through the
>   firewall and we can control the access. If necessary, we can allow
>   any incoming connections based on the IP addresses/ports.
>3. We plan to run a few Internet servers on the firewall machine which
>   are accessible from the outside.
>4. To access our Class C network from the outside, we should be able to
>   login on the firewall machine and go from there.
>
>From what we need, I am not sure proxy services will be sufficient for
>us. Since the traffic between our network and the outside won't be very
>heavy, I am thinking to implement the router/firewall machine on a Unix
>machine with an ISDN interface using a router with a packet filter. I 
>was wondering what free/commercial packet filtering routers available
>for Unix, especially for Linux. Will screend work in this case?
>
>Thanks a lot.
>
>H.J.

You understand that external IP addresses are no longer trustworthy
enough to use for security?  see the articles on "IP Spoofing" on the
CERT archives...

Our firewall is a 'PIX' by Network Translations, inc.  This allows you
to use private IP addresses behind (inside) the firewall, and
dynamically maps them to external public addresses when sockets are
open.  By default NO internal services can be accessed from outside.
We have a 'DMZ' that our T-1 internet connection routes to... The
'DMZ' is a small ether hub with the public name server, mail server,
news server, ftp server, web server and the PIX.  Everything else is
behind the PIX.  Specific protocols to/from specific addresses can be
allowed thru the pix (for instance, we allow SMTP to/from our external
mail router to/from our internal email gateway...).

The advantage of the PIX is that you can have more internal IP
addresses than you have external.. We only have 1 class C (254 nodes)
yet we have over 500 workstations... Sure, only 250 can surf the
internet at once, but thats not a problem...  Also, the PIX is very
transparent, users don't need to configure their clients for proxies,
and applications like IRC that don't have any proxies work fine thru
it.

-jrp

H J Lu wrote:
><snip>
> 4. To access our Class C network from the outside, we should be able to
>    login on the firewall machine and go from there.
>
> H.J.


quite frankly, I'd be reluctant to let any access through the firewall.
the last place I worked at went with a separate dial-in connection 
instead; nothing was allowed through the firewall, and that was exactly 
the way I liked it.  You can set up a decent ISDN dial-in solution w/out 
exposing your firewall; unless your doing a lot of long distance calls, 
that's what I would recommend, for what it's worth.;-)

Fefe Kleiman
*NOT* a net guru

In article <31052904.225B@boeing.hq.nasa.gov>, Chris Kleiman <ckleiman@boeing.hq.nasa.gov> writes:
|> H J Lu wrote:
|> ><snip>
|> > 4. To access our Class C network from the outside, we should be able to
|> >    login on the firewall machine and go from there.
|> >
|> > H.J.
|> 
|> quite frankly, I'd be reluctant to let any access through the firewall.

  Agreed.

|> the last place I worked at went with a separate dial-in connection 
|> instead; nothing was allowed through the firewall, and that was exactly 
|> the way I liked it.  You can set up a decent ISDN dial-in solution w/out 
|> exposing your firewall; unless your doing a lot of long distance calls, 
|> that's what I would recommend, for what it's worth.;-)

  Except that the ISDN solution won't work when traveling.  Most of my
dial in happens from out of town.  Another option might be to contract
with a private network, e.g., Compuserve, and establish a connection
from their net to the company LAN.  This addresses the out of town
situation, but (usually) without the bandwidth provided by ISDN.

  On a few occasions we've actually intalled an ISDN line for a one day
demo.  It actually worked!  (I was afraid the telco wouldn't get the
switch configuration right.)

  Another option, appropriate in some situations, is to establish a
server connected to the Internet completely separate from the company's
internal LAN.  This can support some needs, such as demonstrations, but
probably won't suffice for checking email.  An "outdial" capability on
such a system, configured to use a hard wired connection, could enable
terminal sessions.

|> Fefe Kleiman

    Bob
-- 
Bob Peterson             Work: peterson@csc.ti.com              Expressway Site
Texas Instruments        Home: peterson@mail.zgnews.com         North Building
P.O. Box 655474, MS238   TIMSG: RWP     Voice: +1 214 995 6080  Aisle A4
Dallas, Tx USA 75265     Fido:1:124/5148  FAX: +1 214 995 0304  2-88V97

Bob Peterson (peterson@csc.ti.com) wrote:
: In article <31052904.225B@boeing.hq.nasa.gov>, Chris Kleiman <ckleiman@boeing.hq.nasa.gov> writes:
: |> H J Lu wrote:
: |> ><snip>
: |> > 4. To access our Class C network from the outside, we should be able to
: |> >    login on the firewall machine and go from there.

: |> quite frankly, I'd be reluctant to let any access through the firewall.

:   Agreed.

We run behind a firewall. Something I've been considering is writing a
fake MUD frontend which turns into a telnet login (or whatever) after a 
particular chat sequence, and sitting it on 4201/8888/whatever. (Perhaps 
also blocking for five minutes after a fail.)

Or is the anti-access principle simply that no holes are better than one?

.----------------------------------. mailto:warwick@mmm.co.uk
! Tim Baverstock, IP Network Admin !   http://www.mmm.co.uk [/~warwlck]
!    Opinions are probably mine    !
`----------------------------------'   plan:"Level 1 RFC1149 compliance."

In article <4e866r$riv@superb.csc.ti.com>,
Bob Peterson <peterson@csc.ti.com> wrote:
>In article <31052904.225B@boeing.hq.nasa.gov>, Chris Kleiman <ckleiman@boeing.hq.nasa.gov> writes:
>|> H J Lu wrote:
>|> ><snip>
>|> > 4. To access our Class C network from the outside, we should be able to
>|> >    login on the firewall machine and go from there.
>|> >
>|> > H.J.
>|> 
>|> quite frankly, I'd be reluctant to let any access through the firewall.
>
>  Agreed.




The only way I would allow outside access though our firewall would
be using one-time passwds -- we use SecurID, but there are several 
other solutions including the freely available S-Key.

allen@botcc.com


>
>|> the last place I worked at went with a separate dial-in connection 
>|> instead; nothing was allowed through the firewall, and that was exactly 
>|> the way I liked it.  You can set up a decent ISDN dial-in solution w/out 
>|> exposing your firewall; unless your doing a lot of long distance calls, 
>|> that's what I would recommend, for what it's worth.;-)
>
>  Except that the ISDN solution won't work when traveling.  Most of my
>dial in happens from out of town.  Another option might be to contract
>with a private network, e.g., Compuserve, and establish a connection
>from their net to the company LAN.  This addresses the out of town
>situation, but (usually) without the bandwidth provided by ISDN.
>
>  On a few occasions we've actually intalled an ISDN line for a one day
>demo.  It actually worked!  (I was afraid the telco wouldn't get the
>switch configuration right.)
>
>  Another option, appropriate in some situations, is to establish a
>server connected to the Internet completely separate from the company's
>internal LAN.  This can support some needs, such as demonstrations, but
>probably won't suffice for checking email.  An "outdial" capability on
>such a system, configured to use a hard wired connection, could enable
>terminal sessions.
>
>|> Fefe Kleiman
>
>    Bob
>-- 
>Bob Peterson             Work: peterson@csc.ti.com              Expressway Site
>Texas Instruments        Home: peterson@mail.zgnews.com         North Building
>P.O. Box 655474, MS238   TIMSG: RWP     Voice: +1 214 995 6080  Aisle A4
>Dallas, Tx USA 75265     Fido:1:124/5148  FAX: +1 214 995 0304  2-88V97

Allen Todd (spcapt1@psyche.spc.uchicago.edu) wrote:
: In article <4e866r$riv@superb.csc.ti.com>,
: Bob Peterson <peterson@csc.ti.com> wrote:
: >In article <31052904.225B@boeing.hq.nasa.gov>, Chris Kleiman <ckleiman@boeing.hq.nasa.gov> writes:
: >|> H J Lu wrote:
: >|> ><snip>
: >|> > 4. To access our Class C network from the outside, we should be able to
: >|> >    login on the firewall machine and go from there.
: >|> >
: >|> > H.J.
: >|> 
: >|> quite frankly, I'd be reluctant to let any access through the firewall.
: >
: >  Agreed.
: 
: 
: 
: 
: The only way I would allow outside access though our firewall would
: be using one-time passwds -- we use SecurID, but there are several 
: other solutions including the freely available S-Key.
: 
: allen@botcc.com

This *still* doesn't address session hijacking.  Remember when you pass 
out, the outside machine is vulnerable to a hijack (unless it's FTP, and 
you're moving executables to run on the inside, then you're both 
vulnerable).  Inbound telnet means that anyone with a successfuly session 
hijack attack gets the command prompt on the inside host.  As far as I 
know, only well-managed encryption is adaquate protection against this.  
One-time passwords make sense on dial-in, under some security models, 
over IP, it's a fair risk.

Paul.

: >  Another option, appropriate in some situations, is to establish a
: >server connected to the Internet completely separate from the company's
: >internal LAN.  This can support some needs, such as demonstrations, but
: >probably won't suffice for checking email.  An "outdial" capability on

If you sync'd the e-mail, and protected it with encryption, it wouldn't 
seem to me to be too bad.  An inside mail host could be made to forward 
mail after PGP encrypting it, and then one of the commercial PGP enabled
mail programs could get it for the users.  In this situation, a one-time 
password would probably not be a bad thing.

Your paranoia may vary,

Paul.
-- 

-----------------------------------------------------------------------------
Paul D. Robertson      "My statements in this message are personal opinions
proberts@clark.net      which may have no basis whatsoever in fact."
                                                                     PSB#9280

Chris Kleiman wrote:
> 
> H J Lu wrote:
> ><snip>
> > 4. To access our Class C network from the outside, we should be able to
> >    login on the firewall machine and go from there.
> >
> > H.J.
> 
> quite frankly, I'd be reluctant to let any access through the firewall.
> the last place I worked at went with a separate dial-in connection
> instead; nothing was allowed through the firewall, and that was exactly
> the way I liked it.  You can set up a decent ISDN dial-in solution w/out
> exposing your firewall; unless your doing a lot of long distance calls,
> that's what I would recommend, for what it's worth.;-)
> 
> Fefe Kleiman
> *NOT* a net guru


You still have to be careful.  A dial-in solution can still allow
a hacker to get access to your LAN and files, etc.  One advantage
is you could require a preset call-back before the connection is
allowed.  At least that way you know for sure what number you're
connecting to.  The firewall if done correctly offers good security.
The dial-in option can also be good, but you have to be sure the
users don't take shortcuts and diable some of the security
features.  With the firewall, good software will allow outbound
connections and even allow you to take down TCP/IP (if possible)
and run IPX/SPX for added security.

Tom Sweet (tom.sweet@digilink.net) wrote:
: 
: You still have to be careful.  A dial-in solution can still allow
: a hacker to get access to your LAN and files, etc.  One advantage
: is you could require a preset call-back before the connection is

Dial-back isn't secure at most telcos.  All it takes is "Hello, I'd like 
to order call forwarding for xxx-nnnn" to the telco....

: features.  With the firewall, good software will allow outbound
: connections and even allow you to take down TCP/IP (if possible)
: and run IPX/SPX for added security.

I'm not sure what you're trying to get at here.  IPX is no more 
inherantly secure as a protocol than IP.  Can you explain how running IPX 
would gain "added security"?

Paul.
-- 

-----------------------------------------------------------------------------
Paul D. Robertson      "My statements in this message are personal opinions
proberts@clark.net      which may have no basis whatsoever in fact."
                                                                     PSB#9280