Re: Comcast problems again

On Wed, May 25, 2011 at 1:18 PM, Carey Tyler Schug
<[email protected]> wrote:
> Sorry, a private reply bounced, and this is not totally off topic.
>
> Trev--
>
> Thank you for being so helpful.
>
> Duh!  I remember VLAN trunking.  I didn't think of it because (1) I only
> use my Cisco routers in the lab side of my network, due to
> noise/power/heat, (2) my current firewall computer only has 10 MB/S
> Ethernet adapters (3) when I learned about VLANs, we were told they were
> only supported between Cisco switches and routers) (4) I only have 1900
> series Cisco switches in my lab setup (other than some weird stuff like
> CDDI, Token Ring and FDDI)
>
> I'd still have to use the Cisco 1924 switch just to pass off the traffic
> to the 100 MB/S switch I use.  Certainly is very tempting.  I could
> actually have my office network, lab network and set up a DMZ too (which
> I have been wanting to do).
>
> What I am still looking for on the web is an explanation of how traffic
> coming back to a system is routed to the correct location, and why
> masquerading is different so that Comcast can break it.   And if there
> is a "firewall" solution that Comcast can't detect or break.
>
> I can have the same web page open a couple times each in several
> browsers, but no matter which I am working with, the response comes back
> to the correct one.  I thought one set of instructions I found on
> masquerading used the same technique, because it says from outside the
> network cannot tell I have multiple computers connected.  That is from
> years ago, so perhaps they were being naive at the time..
>
> It may be that one of the web pages I have already browsed would explain
> that, but I lack the prerequisite understanding to follow the explanation.
>
> My guess now is that when I open the same web page in 3 windows on one
> computer, my computer will assign them return port numbers of x, x+1, x+2
> but when my firewall opens the same web page from 3 computers, they get
> assigned return port numbers of x+1000, x+2000, and x+3000 or something
> like that.

close:

The X1,2,3,x+1000 is just random numbers, I think between 1024 and
65565.   call it Y.

A browser sends a request and waits for the response on port Y.

The nat box picks a new port Z, stores Y, Z in memory, sends the
request off.  response comes back to port Z, nat looks up Z, sends the
response to port Y.

I skipped lots of details to keep it understandable.  Like the browser
doesn't actually deal with ports, it deals with the OS which has a
network stack.  Some part of that stack cares about port numbers.  the
NAT box also saves IPs and times so it can age the table to clean out
entries left around from stuff like dropped connections.


> The web pages I have seen don't go into details about what
> numbers are assigned (and none have covered opening the same web page 3
> times on one computer).
>
> Unless I can find a firewall distro that prevents Comcast from
> interfering, any interest in redoing my firewall is a separate unrelated
> topic, with lower priority.
>
> My interest in redoing my firewall other than due to Comcast, mostly
> hinges on being able to do it from a version that runs directly from a
> CD, preferably using a wrie protected floppy disk for fixed
> configuration files and hard disk or flash for dynamic configuration
> (like DHCP leases).  Have you any experience with CD based firewalls?
> Of the ones I could find, zeroshell sounded the best, thought it is
> still beta.  Using a CD and VLANs would be cool, if the computer failed,
> as long as the network card was OK, I could move it to almost any other
> computer, boot up the CD and it would work immediately.
>
> (before anybody forwards the link, I see there is a cisco ws-x5225r for
> $24 including shipping on ebay, I don't know if that would be quieter
> than the 2948 I bought but never powered up till today that is very noisy)
>
> --Carey
>
> On 05/19/2011 11:36 AM, Trev Peterson wrote:
>> I'm pretty sure sub-interfaces can solve this for you rather easily.
>> Give me a call (number in email sig) and I'll help you work out a good
>> topology for this.
>>
>> I should also mention "masquerading" is simply the term used when doing
>> 1 to many NAT (cisco calls it overloading) .  That's it, no extra hiding
>> or such.  In practice the distinction is rarely made and almost all home
>> users are doing masquerading instead of 1 to 1 NAT.
>>
>> Hope this helps,
>>
>>       Trev
> --
> Linux Users Of Northern Illinois (Chicago) - Technical Discussion
> http://luni.org/mailman/listinfo/luni
>



-- 
Carl K
-- 
Linux Users Of Northern Illinois (Chicago) - Technical Discussion 
http://luni.org/mailman/listinfo/luni