extern/shorewall_code
1
0
Fork 1
mirror of https://gitlab.com/shorewall/code.git synced 2025-02-16 17:51:16 +01:00
Code Issues Packages Projects Releases Wiki Activity

Update 'fools' article to clarify wrong-interface issue

Browse Source
This commit is contained in:
Tom Eastep 2009-05-12 08:28:47 -07:00
parent a513809103
commit 45f8a61c12
1 changed files with 8 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

12
docs/FoolsFirewall.xml
View File

@ -39,7 +39,7 @@
<para>Occasionally, we hear from someone who has cabled his firewall's <para>Occasionally, we hear from someone who has cabled his firewall's
external and internal firewall interfaces to the same switch. I call this external and internal firewall interfaces to the same switch. I call this
configuration <firstterm>The Fool's Firewall</firstterm>. </para> configuration <firstterm>The Fool's Firewall</firstterm>.</para>
<para>When the external interface supports broadcast, this configuration <para>When the external interface supports broadcast, this configuration
has two very bad drawbacks:</para> has two very bad drawbacks:</para>
@ -50,8 +50,8 @@
</listitem> </listitem>
<listitem> <listitem>
<para>The up-stream router can send incoming packets to the wrong <para>Both the up-stream router and the local systems can send
interface.</para> incoming packets to the wrong interface.</para>
</listitem> </listitem>
</orderedlist> </orderedlist>
</section> </section>
@ -65,7 +65,7 @@
running Windows) send broadcasts, those systems can be easily detected by running Windows) send broadcasts, those systems can be easily detected by
using a packet sniffer. Once the systems have been spotted, it is child's using a packet sniffer. Once the systems have been spotted, it is child's
play to add an IP address in Fool's internal IP network and bypass his play to add an IP address in Fool's internal IP network and bypass his
"Firewall". </para> "Firewall".</para>
<graphic align="center" fileref="images/Fools.png" /> <graphic align="center" fileref="images/Fools.png" />
</section> </section>
@ -83,5 +83,9 @@
the firewall's internal interface.</para> the firewall's internal interface.</para>
<graphic fileref="images/Foolsa.png" /> <graphic fileref="images/Foolsa.png" />
<para>A similar problem can occur when a local system sends to the
"Firewall" or to the Net. The packets may arrive on the firewall through
the <emphasis>external</emphasis> interface.</para>
</section> </section>
</article> </article>