🚀 go-pugleaf

	I have some question about connexion/security of a Novell 4.1
 (and its client) on the internet.

I see some possibility to have TCP/IP connectivity on the Novel client
 (mostly Win 3.1 and Win 95). I am unsure about the risk associated with
 those solution and some of them I am not even sure if they are working.

Our connexion is throught a 64k Leased Line ussing a Cisco 2501. The
 part of network connected is a thin ethernet cable where standalone PC are
 connected to "browse". We have a class C adresse alocated for us.
Our lan is also a thin ethernet with the Novell server and all other client.
 All the client are PC Windows (no Unix or alike).
There is no firewall of any kind (except the possibility of filtering packet
 on the router) on our network connexion.

1) Direct connexion of the client.

Put everything on the same ethernet cable and put two stack on the client PC
 (one for TCP/IP and one for IPX). No TCP/IP stack on the Novell server or
 on client that do not need internet connectivity. All client have one unique
 TCP/IP address. Windows 95 client use standard TCP/IP stack, Windows 3.1 use
 Cameleon or Trumpet stack.

Security issue: Communication to and from the Novell are done in IPX, and
 "browsing" is done ussing TCP/IP stack.

Security question:
	What are the risk for PC directly connected to the internet that have
		no server process of any kind running ? (unlike Unix)
	What are the risk for PC directly connected to the internet running
		client application (java, mime attachement,...) ?
	What are the risk for the Novell server ?

2) Direct connexion with client using TCP/IP to talk to the Novell server.

I am not sure about this solution, I think Novell can use a TCP/IP stack for
 client connexion. I think that this solution might be more eassy if only one
 stack is needed on client side. This solution might be more risky because the
 whole internet might want to talk to our Novel server (need for a filtre on
 packet directed to the server ?).

3) Dual segment with on machine making the firewall/gateway.

This solution is implemented ussing Nov*ix for internet from Firefox but
 we have trouble running the client stack on Win 95.

I see some possibility of this kind.
a) Novell server with two ethernet card on both inside and outside network
	ussing a special NLM to make adresse stranslation and encapsulation
	of IP packet in IPX packet.
b) Novell server with two ethernet card ussing TCP/IP to talk to it's client
	and routing TCP/IP from it's client to and from the internet.
c) Other box with two ethernet card and making gateway between the two
	network. (or maybe changing from Novell to Win NT server).


I think most of the security is in ussing two diferrent protocole and having
 the Novel not talking TCP/IP at all or only for gatewaying.

If you know any PRODUCT, PAPER or FAQ on thoses subjects, or if you have a
 experiance in related situation (I am not the only one having to connect
 a Novel Lan to the internet). PLEASE reply to me.

PS: price is also an issue, but the technical point of vue is really important
	to me.

		Thanks very much for reading.

						David GLAUDE.