If you set the firewall up as a bridge using 2 interfaces (no IP addresses) and have a third for the management interface (with an IP address), the students will never be able to see the firewall. Nothing for them to hack at. We're running that configuration for an entire campus.
Fully agreed. the only noticeabl thing (beside dsome services being denied :) is a few milli-seconds delay in transmitting the packets.
Bridging is efficient, saves IP's, reduce dramatically the burden of routing. And if it every crashes, you can replace it by a UTP cable!
One downside to bridges is that they can't do NAT, except perhaps in very limited ways.
As for when it fails, yes, you can replace a bridge with a cable, but you're wide open that way. Better to keep a spare device around -- even a commonplace router can give you some protection. Once you've committed to a bridge configuration, if you want to replace the device with something else in a pinch, your options are very limited: cable, switch, or one of the relatively few firewall/platform combinations that supports bridging. OTOH, any firewall will do routing, and even for IP Filter, bridging is supported only on a few platforms.
I prefer a network configuration that doesn't limit my firewall replacement options. The only upside I can see to a bridge configuration is the lack of IP exposure of the device itself, and that's not a significant concern to me -- I just secure the box.
If you're walking into a situation where you have to insert a firewall into an existing network without being able to reconfigure the routing environment, then I'd see the benefit of a bridge for the short term.
-- Jefferson Ogata <[EMAIL PROTECTED]> NOAA Computer Incident Response Team (N-CIRT) <[EMAIL PROTECTED]>
