Re: iptables / bridge mode
In article <[🔎] 3E2B294E.40805@linuxinfo.dk> josefsen@linuxinfo.dk writes:
>I needed to setup a firewall after the network was taken i production,
>so i decided to go bridge mode in order to make the integration
>completely transparent(except for the 30 seconds for the box to learn
>the routing tables and 5 secs to move the plug)
Another way of doing it is a single-address proxy-arp firewall. Like
the bridge solution, there is no need to reconfigure anything but the
firewall. Unlike the bridge, it will show up on traceroutes.
I've got a production single-address proxy-arp firewall with about 200
systems behind it (incoming connection is a t3) on 5 segments.
At some point, I should write it up as a mini-howto. Using the ip
command to control the details of interface configuration and routing
is the main unusual thing.
--
Blars Blarson blarson@blars.org
http://www.blars.org/blars.html
"Text is a way we cheat time." -- Patrick Nielsen Hayden
Reply to: