On 09/30/2011 08:56 AM, Blake T. Pfankuch wrote: > The easy way around the unhappy significant other/minion shaped offspring > solution is to put all of the "end user" devices On a separate VLAN, and then > treat that as an open DMZ. Then everything operational (ironic in a home) on > your secured production network (restrict all outbound/inbound except what is > needed). If you really want to complicate it you should even put your > wireless into a separate VLAN as well, and secure it as appropriate. Gives > you the ability firewall between networks, thus making sure that when your > minions eventually get something nasty going on the PC they use, it doesn't > spread through the rest of the network. Also means you can deploy some form > of content filtering policies through various solutions to prevent your > minions from discovering the sites running on the most recent TLD addition.
Packet fence. Per user vlans. RADIUS back end auth with one time passwords. I'm trying to package all this into a turnkey distro for my own deployment across hundreds of sites. As such I need it anyway and don't mind open sourcing it. It's been an on again/off again project but it's really close to release. > This assumes that most people reading this email have the ability to run > multiple routed subnets behind their home firewall. Be it a layer 3 switch > with ACL's or multiple physical interfaces and the ability to have them act > independently. Routing on a stick to pfSense for me. Though I could use my l3 switch I guess. *shrugs* > Personally I run 8 separate networks (some with multiple routed subnets). > Wireless data, management network, voice networks, game consoles, storage, > internal servers, DMZ servers and Project network. Only reason why there is > no "end user" network is that there are no wired drops anywhere in the house, > so that falls under the wireless data. That network gets internet access and > connectivity to file sharing off the internal servers and all internet > traffic runs through Anti-Virus/Anti-Spyware before going outbound and > inbound. No. You aren't paranoid enough. See above. If it was turnkey, more people would use it. > Blake > > -----Original Message----- > From: Matthew Palmer [mailto:mpal...@hezmatt.org] > Sent: Friday, September 30, 2011 12:19 AM > To: nanog@nanog.org > Subject: Re: Synology Disk DS211J > > On Thu, Sep 29, 2011 at 07:10:10PM -0700, Joel jaeggli wrote: > -- Charles N Wyble char...@knownelement.com @charlesnw on twitter http://blog.knownelement.com Building alternative,global scale,secure, cost effective bit moving platform for tomorrows alternate default free zone.
