EthernetPort

back to http://scratchpad.wikia.com/wiki/Sasecurity

TableOfContents

No connectivity on eht0 port of Mesh node  BR ANSW: BR Try typing mii-tool, which is a program that shows you what is going on BR with your ethernet. The -h qualifier will show you your options.BR You do not need to register with Wiana to try it out. You most likely BR have a ethernet interface that is not being recognized by the software. BR You might try installing the software to disk if this is feasible.BR QUES:BR I've downloaded build 25 dev 81 and burned it to CD (that's the newest BR I could find... Is it really the newest?). It boots and finds my SMC BR 2532 wireless and 3COM 575C Ethernet cards running at 100MB. BR "ifconfig  eth0" shows my IP as 192.168.1.2. I have eth0 plugged into a BR Linksys WRT54G router on one of the 4 internal LAN ports. BR The Linksys is 192.168.1.1. BR I can't ping the Linksys by IP or get any wired network connectivity. BR I know the 3COM card works (tested it in WinXP). Ping reports "no BR route to host." The Linksys is connected to a cable modem with goodBR connectivity via the WAN port. BR I played with MeshAP almost a year ago as a Proof of Concept, but I BR don't remember having any problems like this (although my LAN was BR configured differently - was using StarBand satellite instead of BR Cable as my backhaul). I don't need to register this node with Wiana BR before *anything* (even ping?) works, do I? BR

Lan port security
Lan port security on the 10.x.x.x subnet network  BR Looking at Jeremy's post it looks like I may be able to stop them seeing each other but wouldn't that also stop anyone on the wired lan from being able to communicate with anyone else on the wireless lan totally. I'd need a more controlable solution to make it work.

The answer may lie in the email from Jeremy in "Mesh and RFC1918 (DMZ BR in 10.0.0/16?)". BR It appears that when a Mesh AP is plugged into a 10.X.X.X network, the BR mesh AP can only see the gateway, but the Mesh node (or its clients) BR cannot ping any other devices on the networks, and nor can any other BR device ping the Mesh Node, with the exception of the gateway. BR Theoretically, if Peter changes his LAN to 10.X.X.X then that should BR give him the security he requires. BR --- The watchguard looks like the ticket but the price is more than 2 stand BR alone firewalls so not a totally viable. Its good to know at least some BR systems do support this function. DMZ is unimportant at the moment as BR they seem to remove the firewall from the dmz server but still grant full BR access from the server to the firewalled network. As for linux solution, I BR have thought of that type of system but not really suitable to fill peoples BR ceilings with too many large components. Plus I'd prefer the reliabilty BR of a new firewall over an old pc. In reality if I install a gateway node in BR a premises and supply a lan port on the router for their internal network BR then its really their responsibility to make sure they put a firewall BR between their system and the network. Just would have been nice to offer a BR simpler solution. BR --- I think what you are looking for is a firewall that has 3 or BR more ports. One outside (Red or untrusted), one inside (Green or Trusted), BR and one or more DMZ (Orange or optional). I personally use Watchguard BR firewalls (www.watchguard.com) and their X series comes with six BR interfaces which can be configured so that traffic from one port may BR flow freely to the others or it can be secured in any increment you BR want until there is no ability to connect from one port to another. They BR are expensive however. I think the least expensive one they have is around BR $500.00. If you are more adventuresome and like the linux solutions  BR you can try ipcop (www.ipcop.org). It is similar to meshap in that you take BR a cd and write an image to your hard drive. It will require an intel BR based pc and three nic interfaces. BR > My router isn't the DG834G version that has inbuilt wireless, mine is BR just > the standard DG834. I have also looked on Netgear's website and have BR done a feature comparison between all their routers, and mine doesn't appear BR to be short on features. I just cannot find anywhere that allows me to BR route traffic the way I want. All the settings for static routes refer to BR mapping incoming data on the wan port. I suppose that makes sense since BR firewall manufacturers would be expecting threats from outside the network BR where I am plugging an open network in behind the line of defence. This is not a BR major problem it will just require another firewall in between gateway BR router and wired lan until I find a better way. BR Once again thanks for all the help Phil and if you hear of a router BR that has the ability to seperate the internal lan port traffic, drop me a line BR - Just had a chat with one of our Mesh Network users who works for a BR network security firm. He informs me many backhaul routers (including the latest) with BR wireless > capabilities that have built in internet modules also have inbuilt BR guest > accounts! which make them eminently insecure solution? BR He suggests that you use a non wireless router for your primary BR backhaul connection and connect your Mesh box via its the Ethernet port to the BR router BR --- So your wireless clients connect to their local Mesh AP which BR routes it to the Mesh AP/Gateway machine   and via the router to the backhaul BR they do not see the rest of the network, your other wired BR machines are set to route to the backhaul or where ever you want them to route to  BR Ive looked at my router settings (netgear DG834) and it only seems BR to route the incoming traffic from the wan port not the lan ports. This is BR > exactly what I wanted to do but when I couldn't find a way to do it I BR started asking  questions here. I assumed that other people must have come across BR this problem and found suitable hardware that would route traffic BR straight out to the net and keep seperate from the local wired lan. I even tried BR putting the meshbox in the routers dmz zone and I could still ping my  BR internal network from wireless laptop. If I am missing something in the router BR config I am open to suggestions. BR Another option is pcengines wrap with 3 ethernet ports (and two BR mini-pci slots) running OpenBSD with pf giving you traffic shaping, priorityBR scheduling, firewalling, multipath routing and load balancing in one BR box for about US$130. http://www.openbsd.org/faq/pf/pl/BR

Double Ethernet cards
Double ehternet cards in a mesh: Hostmapping doesn't work with twin cards. Static ip won't work it stops the node node from performing DNS.

=
================ Subject: [MeshAPuser] Second ethernet card In February Rob Davis described how to set up a second ethernet card in a MeshAP thus stick two cards in the box, and then ssh in, and do: ifconfig eth1 0.0.0.0 up brctl addif br0 eth1 and see if it gives you the effect you are looking for. If so, add it to /etc/rc.d/rc.local Look for "Starting captive portal", and try it just below the fi. Subject then was "Re: [MeshAPuser] Four wifi cards in a meshap box")