Great Circle Associates Firewalls
(January 1995)
 

Indexed By Date: [Previous] [Next] Indexed By Thread: [Previous] [Next]

Subject: Re: Firewalls-Digest V4 #11
From: Ken Hardy <ken @ bridge . com>
Date: Tue, 10 Jan 1995 15:43:34 -0600
To: jpatti @ pru-psc . com
Cc: firewalls @ greatcircle . com

>> It's unlikely that under DOS or Windows that the two IP stacks would
>> know anything about each other.  Even on OS/2; I've seen an OS/2 box
>> used as an applications gateway between two networks runing IBM's
>> TCP/IP on one interface and FTP, Inc.'s on the other, and there's
>> absolutely no (direct) interconnection possible between the networks
>> (as I'm told by those involved in the work.)  The only way to get from
>> one network to the other would be to telnet into the OS/2 system and
>> then run the OS/2 telnet, e.g., that came with the TCP/IP stack that's
>> running on the remote interface.
>
>I agree with you on DOS and Windows, but watch out for OS/2. If you run
>IBM's TCP/IP stack over more than one interface, IP forwarding is turned
>on by default. I've seen this with two network cards; we use a dual-homed
>OS/2 PC as a poor man's router (don't ask why). I haven't tried it with
>SLIP or PPP but I'd be careful.

Yes.  The trick here is to use two independent TCP/IP stacks from two
different vendors and give each of them only one of the network
interfaces.  They don't know about each other, and they don't know
about the other interface.


-KH

Indexed By Date Previous: Bastion host sizing
From: mcfowler @ corp . rockwell . com (Mark C. Fowler)
Next: Anything you can do.
From: padgett @ tccslr . dnet . mmc . com (A. Padgett Peterson, P.E. Information Security)
Indexed By Thread Previous: Re: Firewalls-Digest V4 #11
From: jpatti @ pru-psc . com (Joe Patti)
Next: Vendor Request for Proposal
From: Ken Presser <WINSTON1/BALIWS/kpresser%Sara_Lee_Intimates @ mcimail . com>

Google
 
Search Internet Search www.greatcircle.com