On Thu, 31 Jul 2003, Jefferson Ogata wrote:
> Olivier Nicole wrote: > >>If you set the firewall up as a bridge using 2 interfaces (no IP > >>addresses) and have a third for the management interface (with an IP > >>address), the students will never be able to see the firewall. Nothing > >>for them to hack at. We're running that configuration for an entire > >>campus. > > > > Fully agreed. the only noticeabl thing (beside dsome services being > > denied :) is a few milli-seconds delay in transmitting the packets. > > > > Bridging is efficient, saves IP's, reduce dramatically the burden of > > routing. And if it every crashes, you can replace it by a UTP cable! > > One downside to bridges is that they can't do NAT, except perhaps in very > limited ways. > What is it you would need to us NAT for. The FTP proxy works fine on a Bridging firewall without any ip-address including Active mode. I haven't yet tried the other proxies on a bridge but I expect they may very well work too. It is the in-kernel proxies one would want to use in the NAT configuration and examples of how to use them on a transparent bridging firewall have been posted to this list. Larry.
