Re: Transparent Firewall: pros and cons

Hello Simon,

thanks for your reply and valuable input.

Actually my ISP offers a /30 to use for link addresses.
In the settings of the router provided by the ISP (FritzBox 6490) I must
define an ethernet port as "exposed host".
The NIC connected to this specific port is configured with this /30
network. In my understanding the router is working as a modem on this
ethernet port only.
Is my understanding correct that you recommend to use the device in routed
mode.

With regards to Debian installation on Alix board I didn't consider that
there's a downside of systemd.
In fact I found a webpage
<https://wiki.polaire.nl/doku.php?id=debian_buster_alix2d13> that documents
the installation of Debian Buster on an Alix board.
What is the downside using systemd on an Alix board?

THX

Am Do., 6. Jan. 2022 um 13:24 Uhr schrieb Simon <[email protected]>:

> Thomas <[email protected]> wrote:
>
> > With regards to the transparent / bridge firewall I think to skip this
> because I cannot determine if my ISP is offering WAN-routing that is a
> pre-requisite for a transparent / bridge firewall.
>
> I think you may have this the other way around.
>
> A transparent bridge looks just like a network switch to the rest of the
> network - i.e. traffic passes through it without modification. Hence
> anywhere you can use an ethernet connection you can insert a bridge.
> The biggest problem is where you have it between your ISP router and your
> internal router. In that case, it only sees traffic after it’s been through
> any NAT (or other packet mangling) in your router - hence you can’t (for
> example) permit/block traffic to/from specific devices unless you do it by
> protocol alone. It’s typically easier to do the filtering in the same
> device that’s doing the mangling.
>
> If the ISP offers friendly routing options (e.g. they offer a /30 to use
> for link addresses between their router and yours, and route traffic to a
> different subnet via your router IP), then it’s much easier to use a device
> in routed mode. I’ve never seen this on “home” services, and on “business”
> services I’ve seen different suppliers offer some “interesting” options
> regarding this.
>
> Simon
>
>
> Note: Although it’s not related to your query, I stopped using Debian
> after Squeeze - i.e. several releases ago - as I’m not prepared to allow
> SystemD onto anything I’m responsible for maintaining. While I’m only doing
> this for home use now (used to do it professionally until about 4 years
> ago) I only use Devuan for new installs.
> Without looking at any details, I suspect that running a “small”
> installation for the sort of hardware under discussion is somewhat harder
> now with the hard dependency on SystemD baked into Debian.
>
>
>
> _______________________________________________
> Shorewall-users mailing list
> [email protected]
> https://lists.sourceforge.net/lists/listinfo/shorewall-users
>