Re: Comcast problems again

Sorry, a private reply bounced, and this is not totally off topic.

Trev--

Thank you for being so helpful.

Duh!  I remember VLAN trunking.  I didn't think of it because (1) I only 
use my Cisco routers in the lab side of my network, due to 
noise/power/heat, (2) my current firewall computer only has 10 MB/S 
Ethernet adapters (3) when I learned about VLANs, we were told they were 
only supported between Cisco switches and routers) (4) I only have 1900 
series Cisco switches in my lab setup (other than some weird stuff like 
CDDI, Token Ring and FDDI)

I'd still have to use the Cisco 1924 switch just to pass off the traffic 
to the 100 MB/S switch I use.  Certainly is very tempting.  I could 
actually have my office network, lab network and set up a DMZ too (which 
I have been wanting to do).

What I am still looking for on the web is an explanation of how traffic 
coming back to a system is routed to the correct location, and why 
masquerading is different so that Comcast can break it.   And if there 
is a "firewall" solution that Comcast can't detect or break.

I can have the same web page open a couple times each in several 
browsers, but no matter which I am working with, the response comes back 
to the correct one.  I thought one set of instructions I found on 
masquerading used the same technique, because it says from outside the 
network cannot tell I have multiple computers connected.  That is from  
years ago, so perhaps they were being naive at the time..

It may be that one of the web pages I have already browsed would explain 
that, but I lack the prerequisite understanding to follow the explanation.

My guess now is that when I open the same web page in 3 windows on one 
computer, my computer will assign them return port numbers of x, x+1, x+2
but when my firewall opens the same web page from 3 computers, they get 
assigned return port numbers of x+1000, x+2000, and x+3000 or something 
like that.  The web pages I have seen don't go into details about what 
numbers are assigned (and none have covered opening the same web page 3 
times on one computer).

Unless I can find a firewall distro that prevents Comcast from 
interfering, any interest in redoing my firewall is a separate unrelated 
topic, with lower priority.

My interest in redoing my firewall other than due to Comcast, mostly 
hinges on being able to do it from a version that runs directly from a 
CD, preferably using a wrie protected floppy disk for fixed 
configuration files and hard disk or flash for dynamic configuration 
(like DHCP leases).  Have you any experience with CD based firewalls?  
Of the ones I could find, zeroshell sounded the best, thought it is 
still beta.  Using a CD and VLANs would be cool, if the computer failed, 
as long as the network card was OK, I could move it to almost any other 
computer, boot up the CD and it would work immediately.

(before anybody forwards the link, I see there is a cisco ws-x5225r for 
$24 including shipping on ebay, I don't know if that would be quieter 
than the 2948 I bought but never powered up till today that is very noisy)

--Carey

On 05/19/2011 11:36 AM, Trev Peterson wrote:
> I'm pretty sure sub-interfaces can solve this for you rather easily.
> Give me a call (number in email sig) and I'll help you work out a good
> topology for this.
>
> I should also mention "masquerading" is simply the term used when doing
> 1 to many NAT (cisco calls it overloading) .  That's it, no extra hiding
> or such.  In practice the distinction is rarely made and almost all home
> users are doing masquerading instead of 1 to 1 NAT.
>
> Hope this helps,
>
> 	Trev
-- 
Linux Users Of Northern Illinois (Chicago) - Technical Discussion 
http://luni.org/mailman/listinfo/luni