I think I've got something

Post #137,387 by tuberculosis 1/23/04 7:21:47 PM 8/21/07 6:36:43 AM Reply	I think I've got something We'll see how stabile it is. The ActionTec is now running in routed mode to allow my 5 ip addresses past it. I set up its DHCP to dynamically serve 3 of the 5, and statically assigned the main one to the G4's Airport interface. I then put the linksys in the kitchen, turned off its DHCP, selected router mode, connected the uplink port of the lan side to one of the ports on the ActionTec. I now have the G4 with a static ip address reachable over a wireless link. My laptops are grabbing their ips from the DHCP pool (which I would prefer to be not reachable from outside...) over the same wireless network. I have the PC and G4 talking over ethernet in their own little private idaho. Its a little annoying in that I can't seem to reach the internet from the PC directly and have to download stuff to the G4, then ftp it from the PC, but I'm planning to relegate the PC to just oracle server soon anyhow. So this is actually fine. What's good - it works. What's not good - everything is hanging out there. I feel like I need a firewall in here or something. Realistically I only want to expose ssh, www, and scp to the world. I've got an old sonicwall soho kicking around here somewhere.... Can I fiddle the DHCP pool to serve addresses that are not routed outside? Aren't addresses in the 10.0.0.x range only routed locally? Something like that? Networking is clearly a black art and too hard for the average bear. No wonder millions of PCs are hacked every day. "I believe that many of the systems we build today in Java would be better built in Smalltalk and Gemstone." -- Martin Fowler, JAOO 2003 Edited by tuberculosis Aug. 21, 2007, 06:36:43 AM EDT Expand All History
Post #137,394 by deSitter 1/23/04 7:27:53 PM Reply	Re: I think I've got something Not a matter of routability, the 10. and 172.16. and 192.168. networks are forbidden from being routed by Internet trunk carriers. You can quite easily set up static routes for private networks. RFC 1918: [link\|http://www.faqs.org/rfcs/rfc1918.html\|http://www.faqs.org/rfcs/rfc1918.html] -drl
Post #137,406 by morganek 1/23/04 8:17:18 PM Reply	How about this: Deactivate the DHCP server in the ActionTec. Connect the WAN port on the Linksys to the ActionTec (with crossover cable if need be). Assign one of your real static IP addresses to the WAN interface (on the Setup page). Configure the Linksys with a non-routable address on its "internal" interface in the "LAN IP Address" field on the Setup page. Put the Linksys back into gateway mode. Activate its DHCP server and assign it a block of addresses to dispense on your non-routable subnet. Connect the uplink port on the LAN side of your Linksys to the ActionTec (like it is now). Keep your G4 configuration the same as it is now. What this does is give you two different subnets on what is effectively a single ethernet segment. The static IP information on your G4 makes it participate in the subnet that your DSL provides. The DHCP addresses dispensed by the Linksys will put your laptops and other wireless machines on the non-routable subnet. If you want to put another machine on the internet, just configure it to be on the public subnet like you did with the G4. I am guessing that your Oracle server does not have wireless. This configuration does not give your Oracle machine internet access.
Post #137,515 by tuberculosis 1/24/04 1:37:38 PM 8/21/07 6:39:19 AM Reply	Bingo! That was it - I'm able to use a local address on either the wireless or lan network for the DMZ host and only my DMZ host is visible to the world. I'll sleep better tonight. Networking is very painful - this was - what - something like 4 half days of work to figure this out? Its much slowed down by the fact that everytime you change some address you have to run around and re-init all the devices that used to talk to it - including the device (laptop) you were using to talk to it to change the config. I expect that by mucking with the port forwarding I can get more machines on the net to do their various jobs. Thanks again! "I believe that many of the systems we build today in Java would be better built in Smalltalk and Gemstone." -- Martin Fowler, JAOO 2003 Edited by tuberculosis Aug. 21, 2007, 06:39:19 AM EDT Expand All History

Welcome to IWETHEY!