Vlan isolation, inside and outside for
simplest of terms. Vlan 1 is inside, Vlan 2 is outside. By
nature, one cannot reach another, thus Virtual LAN's.
In the middle sits a bridge, and iptables mangles packets between them. This is your nat, firewall, application inspection, etc. A process on the wan grabs a dhcp address, adds it outside, and a default route to the upstream dslam or cmts. It also registers it as the external address to nat your internal traffic as to the world, effectively hiding your internal routable subnets. The inside vlan uses a private address, usually 192.168.1.1/24 by default. This gives you 253 usable address, and gives out a subset of that via dhcp. When clients come up wired or wireless, they get an address from the dhcp server when they broadcast for an address. Routers usually bridge the wireless 802.11 radio(s) to this vlan as well, bringing them all into the 192.168.1.0/24 subnet on that vlan. The DHCP server gives wired or wireless clients a local 192.168.1.0/24 address out of the subset it hands out, including the gateway for the subnet (itself, 192.168.1.1), and dns servers for it, again itself. They get a local dns server that is usually dnsmasq running on the router, caching and forwarding to the upstream provider dns servers given externally to the router when it gets its WAN address. It forwards your requests on mostly. Wireless does some form of security, hopefully, letting client onto the ssid with a pre-share key or some other. No wpa1, only wpa2+aes. Tkip is exploitable, so is wps pin registration (easily crackable without mitigation routines). Most routers these days use dd-wrt, or some variant, usually some oem abomination hack of linux. Your wrt54g is like the granddaddy of dd-wrt routers, see what generation it is and see if it's upgradable. Probably doing yourself a favor upgrading the 10yr old firmware to something secure anyways, keeping some foreign entity from redirecting your dns for bank servers to snatch your credentials. Clear as mud? Google lots of those words. -mb On 10/19/2014 12:31 AM, Michael Havens wrote:
|
--------------------------------------------------- PLUG-discuss mailing list - PLUG-discuss@lists.phxlinux.org To subscribe, unsubscribe, or to change your mail settings: http://lists.phxlinux.org/mailman/listinfo/plug-discuss