> If you set the firewall up as a bridge using 2 interfaces (no IP > addresses) and have a third for the management interface (with an IP > address), the students will never be able to see the firewall. Nothing > for them to hack at. We're running that configuration for an entire > campus.
Fully agreed. the only noticeabl thing (beside dsome services being denied :) is a few milli-seconds delay in transmitting the packets. Bridging is efficient, saves IP's, reduce dramatically the burden of routing. And if it every crashes, you can replace it by a UTP cable! There are a few coinsiderations you mut be carefull about when configuring your ipfilter though, because your router just outside your firewall is on the same subnet as your network inside the firewall, so the router must ba able to ARP resolve addresses of your internal hosts. BUT (FreeBSD 4.8) there is one major issue that I was not able to solve, on the firewall machine ARP is bouncing the IP of the management interface, back and forth between the management interface and the inside bridged interface. I'd love to have help on that. Best regards, Olivier
