Re: ID local machines before forwarding?
- From: Mike Jones <Not@xxxxxxxxxxx>
- Date: Mon, 08 Dec 2008 21:56:06 GMT
Responding to Jasen Betts:
On 2008-12-07, Mike Jones <Not@xxxxxxxxxxx> wrote:
I now have a need to make sure only certain machines on the internal
LAN can get forwarded out into the wild internet (through one common
gateway machine).
surest: put the locked down machines on a different interface (get
another network card and put them on a different subnet). write
forwarding rules that don't include forwarding traffic from that subnet.
the above has a physical barrier which will block anything software can
attempt...
Pretty solid idea. I'd not thought of this one.
However, I have a laptop with XP and Zenwalk on it. Guess which OS I
don't want ever connecting to the internet? And guess which OS I /want/
to be able to access the internet with?
Yup. I'm trying to create some kind of filter system that I can be sure
won't let BarbieWare through, on the same hardware that might be running
an acceptable Linux OS.
It crossed my mind to create some kind of ssh handshake before the router
machine would accept traffic for forwarding, something the Linux OS could
be set up to do, but the M$ OS would naturally fail. Over ambitious?
I'm thinking about anything that could be used to be an identity key to
allow or block based on that.
[...]
IOW, if its not "this machine", running "this account" on "this OS",
then drop (and log?).
if you want to block based on the user (not the machine) you could not
forward any IP packets from the LAN to the internet but instead require
your clients machines to use PPPoE through your linux box... set the
linux box up as a PPP server...
I'll have to look into this one.
Thanks for the tips! :)
--
*===( http://www.400monkeys.com/God/
*===( http://principiadiscordia.com/
*===( http://www.zenwalk.org/
.
- Follow-Ups:
- Re: ID local machines before forwarding?
- From: Lawrence D'Oliveiro
- Re: ID local machines before forwarding?
- References:
- ID local machines before forwarding?
- From: Mike Jones
- Re: ID local machines before forwarding?
- From: Jasen Betts
- ID local machines before forwarding?
- Prev by Date: Re: Linux netbooks
- Next by Date: rsync between FAT32 and XFS partitions
- Previous by thread: Re: ID local machines before forwarding?
- Next by thread: Re: ID local machines before forwarding?
- Index(es):
Relevant Pages
|
