Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > comp.os.linux.misc > #13525 > unrolled thread

Home network - design ideas

Back to article view | Back to comp.os.linux.misc

Contents

  Home network - design ideas Tim Watts <tw_usenet@dionic.net> - 2015-01-31 11:36 +0000
    Re: Home network - design ideas William Unruh <unruh@invalid.ca> - 2015-01-31 18:23 +0000
      Re: Home network - design ideas Tim Watts <tw_usenet@dionic.net> - 2015-01-31 20:02 +0000
        Re: Home network - design ideas Chick Tower <c.tower@deadspam.com> - 2015-02-03 20:17 +0000
          Re: Home network - design ideas The Natural Philosopher <tnp@invalid.invalid> - 2015-02-03 20:33 +0000
          Re: Home network - design ideas Tim Watts <tw_usenet@dionic.net> - 2015-02-03 20:47 +0000
    Re: Home network - design ideas Moe Trin <ibuprofin@painkiller.example.tld.invalid> - 2015-01-31 20:37 +0000
      Re: Home network - design ideas William Unruh <unruh@invalid.ca> - 2015-01-31 22:24 +0000
        Re: Home network - design ideas Moe Trin <ibuprofin@painkiller.example.tld.invalid> - 2015-02-01 16:21 +0000
          Re: Home network - design ideas John Hasler <jhasler@newsguy.com> - 2015-02-01 10:52 -0600
            Re: Home network - design ideas Moe Trin <ibuprofin@painkiller.example.tld.invalid> - 2015-02-01 20:42 +0000
              Re: Home network - design ideas Marc Haber <mh+usenetspam1118@zugschl.us> - 2015-02-02 07:24 +0100
      Re: Home network - design ideas Tim Watts <tw_usenet@dionic.net> - 2015-01-31 23:43 +0000
        Re: Home network - design ideas Moe Trin <ibuprofin@painkiller.example.tld.invalid> - 2015-02-01 16:23 +0000

#13525 — Home network - design ideas

Hiya,

This is not a "how do I do this" - that's not a problem.

I'd just like to bat an idea or two as I have a couple of ways and I 
cannot decide which is best...

OK - I have a /27 IPv4 public block (yay for good ISPs!)
That's enough for:

4, later 5 servers
Various IP cams
Several laptops
Various infrastructure

But not enough for every ad hoc smartphone and visitor items.

My PPPoE endpoint *and* router *and* firewall is a linux box, Atom 
MiniITX that can manage gigabit throughput.

Switches are NetGear gigabit SmartSwitches


So - Option 1
=============

1) Visitor network on say 10.0.1.x, NATed
2) My stuff on /27 including infrastructure like wifi, switches etc
3) Ad hoc smartphones etc use visitor net

Pro: Clean and simple
Pro: Internal-Internal traffic is switched (fast, no real bottleneck)

Con: Might still might hit the /27 limit one day
Con: Still need to NAT all my Netflix devices as Unblock-US only works 
with one client IP

Option 2
========

1) Visitor network on say 10.0.1.x, NATed
2) My really public stuff (like IPCams, servers, home automation) on /27
3) My other stuff on another private, say 10.0.0.x, NATed

Pro: Unlimited local IPs and I will NOT hit the end of a /27 for my 
public stuff

Con: Certain Internal-Internal traffic gets routed so will bottleneck

Option 3
========
1) Visitor network on say 10.0.1.x, NATed
2) All my stuff on private, 10.0.0.x NATed
3) Router does IP translation from /27 to 10.0.0.x for public stuff

Pro: Fast switching for Internal-Internal

Con: Needs either split-DNS (have this now, do not like it) OR the 
router will end up doing reflection-translation for Internal-Internal

Pro: Saves one IP that would otherwise be used on the router at the gateway

Pro: Very flexible.

Con: I just don't like it. I am very much pro using public IPs as the 
Internet originally intended. I hate NAT but it is OK for misc visitor 
stuff. Prefer to have my regular kit on public IPs and clean.


There is an Option 4, dual public/private IPs on certain devices but 
that was so disgusting I do not want to go there again...


What would you do?

[toc] | [next] | [standalone]

#13527

On 2015-01-31, Tim Watts <tw_usenet@dionic.net> wrote:
> Hiya,
>
> This is not a "how do I do this" - that's not a problem.
>
> I'd just like to bat an idea or two as I have a couple of ways and I 
> cannot decide which is best...
>
> OK - I have a /27 IPv4 public block (yay for good ISPs!)
> That's enough for:
>
> 4, later 5 servers
> Various IP cams
> Several laptops
> Various infrastructure

And then you always have 2^24 address block in the 10. /8 address block,
plus NAT. Why would yo uwant your IP cams, etc on a public IP address?


>
> But not enough for every ad hoc smartphone and visitor items.
>
> My PPPoE endpoint *and* router *and* firewall is a linux box, Atom 
> MiniITX that can manage gigabit throughput.
>
> Switches are NetGear gigabit SmartSwitches
>
>
> So - Option 1
>=============
>
> 1) Visitor network on say 10.0.1.x, NATed
> 2) My stuff on /27 including infrastructure like wifi, switches etc
> 3) Ad hoc smartphones etc use visitor net
>
> Pro: Clean and simple
> Pro: Internal-Internal traffic is switched (fast, no real bottleneck)
>
> Con: Might still might hit the /27 limit one day

Do you recall the adage of computer purchasing. Only purchase today what
you need for today. Tomorrow it will be 1/100 the price and with options
you never thought of. 

> Con: Still need to NAT all my Netflix devices as Unblock-US only works 
> with one client IP
>
> Option 2
>========
>
> 1) Visitor network on say 10.0.1.x, NATed
> 2) My really public stuff (like IPCams, servers, home automation) on /27
> 3) My other stuff on another private, say 10.0.0.x, NATed

You can do what you want with 10.x You have 2^24 different addresses.
How you arrange then is up to you. (Mind you NATing 2^24 systems at once
might be a bit tricky).

>
> Pro: Unlimited local IPs and I will NOT hit the end of a /27 for my 
> public stuff
>
> Con: Certain Internal-Internal traffic gets routed so will bottleneck

All stuff gets routed, whether internal or external. 10.0.0.x vs
10.0.1.x is no different from 10.0.0.123 vs 10.0.0.124

Unless you make it different internally.


>
> Option 3
>========
> 1) Visitor network on say 10.0.1.x, NATed
> 2) All my stuff on private, 10.0.0.x NATed
> 3) Router does IP translation from /27 to 10.0.0.x for public stuff

>
> Pro: Fast switching for Internal-Internal
>
> Con: Needs either split-DNS (have this now, do not like it) OR the 
> router will end up doing reflection-translation for Internal-Internal
>
> Pro: Saves one IP that would otherwise be used on the router at the gateway
>
> Pro: Very flexible.
>
> Con: I just don't like it. I am very much pro using public IPs as the 
> Internet originally intended. I hate NAT but it is OK for misc visitor 
> stuff. Prefer to have my regular kit on public IPs and clean.

??? NAT is "as originally intended" And IPV6 would allow you huge
amounts of IP space. But would not solve the routing bottlenecks.

>
>
> There is an Option 4, dual public/private IPs on certain devices but 
> that was so disgusting I do not want to go there again...
>
>
> What would you do?

Stop worrying.

[toc] | [prev] | [next] | [standalone]

#13528

On 31/01/15 18:23, William Unruh wrote:
> On 2015-01-31, Tim Watts <tw_usenet@dionic.net> wrote:
>> Hiya,
>>
>> This is not a "how do I do this" - that's not a problem.
>>
>> I'd just like to bat an idea or two as I have a couple of ways and I
>> cannot decide which is best...
>>
>> OK - I have a /27 IPv4 public block (yay for good ISPs!)
>> That's enough for:
>>
>> 4, later 5 servers
>> Various IP cams
>> Several laptops
>> Various infrastructure
>
> And then you always have 2^24 address block in the 10. /8 address block,
> plus NAT. Why would yo uwant your IP cams, etc on a public IP address?
>

So I can view them without buggering about with VPN on a smartphone.

Let's assume I will firewall them to my usual networks (quite wide in 
the case of my mobile 3G) and I might put an apache proxy in front of 
them with authentication.

>>
>> But not enough for every ad hoc smartphone and visitor items.
>>
>> My PPPoE endpoint *and* router *and* firewall is a linux box, Atom
>> MiniITX that can manage gigabit throughput.
>>
>> Switches are NetGear gigabit SmartSwitches
>>
>>
>> So - Option 1
>> =============
>>
>> 1) Visitor network on say 10.0.1.x, NATed
>> 2) My stuff on /27 including infrastructure like wifi, switches etc
>> 3) Ad hoc smartphones etc use visitor net
>>
>> Pro: Clean and simple
>> Pro: Internal-Internal traffic is switched (fast, no real bottleneck)
>>
>> Con: Might still might hit the /27 limit one day
>
> Do you recall the adage of computer purchasing. Only purchase today what
> you need for today. Tomorrow it will be 1/100 the price and with options
> you never thought of.

Good point.

Also, though, plan for the future :)

>> Con: Still need to NAT all my Netflix devices as Unblock-US only works
>> with one client IP
>>
>> Option 2
>> ========
>>
>> 1) Visitor network on say 10.0.1.x, NATed
>> 2) My really public stuff (like IPCams, servers, home automation) on /27
>> 3) My other stuff on another private, say 10.0.0.x, NATed
>
> You can do what you want with 10.x You have 2^24 different addresses.
> How you arrange then is up to you. (Mind you NATing 2^24 systems at once
> might be a bit tricky).
>
>>
>> Pro: Unlimited local IPs and I will NOT hit the end of a /27 for my
>> public stuff
>>
>> Con: Certain Internal-Internal traffic gets routed so will bottleneck
>
> All stuff gets routed, whether internal or external. 10.0.0.x vs
> 10.0.1.x is no different from 10.0.0.123 vs 10.0.0.124
>
> Unless you make it different internally.

Well, except the latter get *switched* which is a lot more efficient - 
my switches can handle several gig on the backplane - my router (aka 
linux box) will be sharing the 1gig in and back out to the same physical 
network...

>
>>
>> Option 3
>> ========
>> 1) Visitor network on say 10.0.1.x, NATed
>> 2) All my stuff on private, 10.0.0.x NATed
>> 3) Router does IP translation from /27 to 10.0.0.x for public stuff
>
>>
>> Pro: Fast switching for Internal-Internal
>>
>> Con: Needs either split-DNS (have this now, do not like it) OR the
>> router will end up doing reflection-translation for Internal-Internal
>>
>> Pro: Saves one IP that would otherwise be used on the router at the gateway
>>
>> Pro: Very flexible.
>>
>> Con: I just don't like it. I am very much pro using public IPs as the
>> Internet originally intended. I hate NAT but it is OK for misc visitor
>> stuff. Prefer to have my regular kit on public IPs and clean.
>
> ??? NAT is "as originally intended" And IPV6 would allow you huge
> amounts of IP space. But would not solve the routing bottlenecks.

I do have IPv6 block too - but not yet configured it as too few other 
places support it - but one day...

>> What would you do?
>
> Stop worrying.
>

:)

Thanks for your reply - I have more to add but my spag bol is nearly 
ready so I must run and reply again later...

[toc] | [prev] | [next] | [standalone]

#13582

On 2015-01-31, Tim Watts wrote:
> Thanks for your reply - I have more to add but my spag bol is nearly 
> ready so I must run and reply again later...

There must have been some line noise at the end of your message, Tim.
Or maybe your cat jumped on the keyboard.  Whatever, it made it look 
like you typed "spag bol".  So what is it that was nearly ready?
-- 
                                 Chick Tower

For e-mail:  colm DOT sent DOT towerboy AT xoxy DOT net

[toc] | [prev] | [next] | [standalone]

#13583

On 03/02/15 20:17, Chick Tower wrote:
> On 2015-01-31, Tim Watts wrote:
>> Thanks for your reply - I have more to add but my spag bol is nearly
>> ready so I must run and reply again later...
>
> There must have been some line noise at the end of your message, Tim.
> Or maybe your cat jumped on the keyboard.  Whatever, it made it look
> like you typed "spag bol".  So what is it that was nearly ready?
>
Spaghetti a la Bolognesi

-- 
Everything you read in newspapers is absolutely true, except for the 
rare story of which you happen to have first-hand knowledge. – Erwin Knoll

[toc] | [prev] | [next] | [standalone]

#13584

On 03/02/15 20:17, Chick Tower wrote:
> On 2015-01-31, Tim Watts wrote:
>> Thanks for your reply - I have more to add but my spag bol is nearly
>> ready so I must run and reply again later...
>
> There must have been some line noise at the end of your message, Tim.
> Or maybe your cat jumped on the keyboard.  Whatever, it made it look
> like you typed "spag bol".  So what is it that was nearly ready?
>

Spaghetti Bolognese :)

[toc] | [prev] | [next] | [standalone]

#13529

On Sat, 31 Jan 2015, in the Usenet newsgroup comp.os.linux.misc, in article
<jarupb-7ds.ln1@squidward.dionic.net>, Tim Watts wrote:

>I'd just like to bat an idea or two as I have a couple of ways and I 
>cannot decide which is best...

The entire key is "how do you plan on using it"?   How many systems
need access _FROM_ the outside world, and for how many different
services?     Don't tell us, but think about that.

>OK - I have a /27 IPv4 public block (yay for good ISPs!)

As of the middle of the month, there were still 108676424 IPv4 addresses
unassigned/unallocated by IANA and the five Regional Internet Registries,
compared to 164356008 a year ago and 294994272 three years ago.  On the
other hand, IPv6 is wide open (1.2670 x 10^34 addresses assigned or
allocated, which is a mere 0.0298 percent of of what IANA has released).

>That's enough for:

>4, later 5 servers
>Various IP cams
>Several laptops
>Various infrastructure

Again, what has to be accessible from the outside world.

>But not enough for every ad hoc smartphone and visitor items.

Are you trying to provide an open hot-spot for everyone?  Are any/all of
those visitors or ad hoc systems offering services to the world?   If
not, they really don't need direct access - NAT is good enough.    Of
the options you show, all have

   1) Visitor network on say 10.0.1.x, NATed

so that's no problem.

>Option 1

>2) My stuff on /27 including infrastructure like wifi, switches etc
>3) Ad hoc smartphones etc use visitor net

>Pro: Clean and simple
>Pro: Internal-Internal traffic is switched (fast, no real bottleneck)

Pro: doesn't waste real IPs on devices that don't need to be accessible
from the world.

>Con: Might still might hit the /27 limit one day

By then, your ISP will be handing out IPv6 blocks, and the smallest one
the IETF contemplates being handed out to end customers is a /64 which
gives you 1.845 x10^19 addresses - that's enough to let you set up 4.29
billion /96 subnets - each being as large as all IPv4 space. Non-problem.

>Option 2

>2) My really public stuff (like IPCams, servers, home automation) on /27

Color me paranoid, but does all of that really need to be accessible from
the world?   Given the current standard of security being displayed by
the home automation community, I'd be VERY hesitant to make them
accessible.  (Heck, there is a folded piece of duct-tape covering the
lens of the built-in camera on the lap-tops, only moved out of the way
when I intentionally want to use the it,)

>Con: Certain Internal-Internal traffic gets routed so will bottleneck

Ohhhh, the freeway is narrowing down from 12 lanes in this direction to
only 11 - that might cause congestion in Los Angeles, but is not likely
to be a problem in other metropolitan areas.   As your hosts don't all
have point-to-point connections to all other hosts, you've already got a
bottleneck in those switches - but I don't see it as a PRACTICAL problem.

>Option 3

>1) Visitor network on say 10.0.1.x, NATed
>2) All my stuff on private, 10.0.0.x NATed
>3) Router does IP translation from /27 to 10.0.0.x for public stuff

>Pro: Fast switching for Internal-Internal

Above - there is an insignificant bottleneck

>Con: Needs either split-DNS (have this now, do not like it) OR the 
>router will end up doing reflection-translation for Internal-Internal

I suppose it depends on how dynamic the hosts are.  MOST of my internal
hosts are fixed (and have fixed addresses/hostnames), and don't go
"walkies" often enough to worry about.   The truly dynamic stuff is on
a separate sub-net, but they don't offer services, so a DDNS slaved to
the DHCP server is sufficient.

>Con: I just don't like it. I am very much pro using public IPs as the 
>Internet originally intended. I hate NAT but it is OK for misc visitor 
>stuff. Prefer to have my regular kit on public IPs and clean.

When the Internet was originally developed, the user community was much
smaller, more professional, and better behaved.  While there were
rather enormous security holes, they were rarely exploited because
people didn't think of them, and/or had the good sense to not try to
exploit them.   If you scan the "Risks Digest" (news://comp.risks/), I
am no longer amazed at the wide-spread lack of common-sense security.
Why the control computers at the Smithfield Nuclear Power plant need to
be accessible from the world at large...  so the local stores, bars or
whatever can upload pictures (and targeted advertisements) of the
products they are delivering to Homer Simpson for his approval?

Your option 2 (public stuff on the /27, everything else NATed) is likely
the best choice if you have a lot of public stuff - otherwise, I'd go
with option 3, which reduces exposure, but at the cost of extra CPU
cycles on the router doing NAT.  It's probably not a bandwidth issue.

        Old guy

[toc] | [prev] | [next] | [standalone]

#13530

On 2015-01-31, Moe Trin <ibuprofin@painkiller.example.tld.invalid> wrote:
> On Sat, 31 Jan 2015, in the Usenet newsgroup comp.os.linux.misc, in article
>

> As of the middle of the month, there were still 108676424 IPv4 addresses
> unassigned/unallocated by IANA and the five Regional Internet Registries,

That is about the same as one /14  block. (Ie 2^(-14) th of the address
space)

> compared to 164356008 a year ago and 294994272 three years ago.  On the
> other hand, IPv6 is wide open (1.2670 x 10^34 addresses assigned or
> allocated, which is a mere 0.0298 percent of of what IANA has released).

If only anyone could use them :-)

[toc] | [prev] | [next] | [standalone]

#13536

On Sat, 31 Jan 2015, in the Usenet newsgroup comp.os.linux.misc, in article
<majkm4$efv$2@dont-email.me>, William Unruh wrote:

>Moe Trin <ibuprofin@painkiller.example.tld.invalid> wrote:

>> As of the middle of the month, there were still 108676424 IPv4
>> addresses unassigned/unallocated by IANA and the five Regional
>> Internet Registries,

>That is about the same as one /14  block. (Ie 2^(-14) th of the address
>space)

actually, it's about 6 1/2 "/8"s formerly known as Class As.

>> compared to 164356008 a year ago and 294994272 three years ago.

Long ago, there was this gentle request (RFC1917)

  1917 An Appeal to the Internet Community to Return Unused IP Networks
       (Prefixes) to the IANA. P. Nesser II. February 1996. (Format:
       TXT=23623 bytes) (Also BCP0004) (Status: BEST CURRENT PRACTICE)

that is finally bearing fruit. Several block, or portions of blocks
have been returned.  One example being 47.0.0.0/8 which was assigned to
Bell Northern in January 1989. They retain a little over half of it
now, with the rest reissued to several ISPs.

What is quite noticeable now is the size of the chunks being handed out.
Two years ago, /12s were not uncommon, and /16s were relatively common.
Now, the block issued is more likely to be a /20, /21 or most commonly,
a /22 (even by LACNIC which had a possibly false reputation for being
"generous").

>> On the other hand, IPv6 is wide open (1.2670 x 10^34 addresses
>> assigned or allocated, which is a mere 0.0298 percent of of what
>> IANA has released).

>If only anyone could use them :-)

Certainly won't hear me differing - about two weeks ago I was at a
hot-spot operated by the city library with a laptop and noticed that
/sbin/ifconfig was reporting a routable IPv6 address on wlan0 (in
addition to the "normal" masqueraded RFC1918 address).  Playing with
tcptraceroute6, it was soon apparent that half of the routes wound up
being "via" Japan (even Phoenix to Denver and Phoenix to Dallas).
"Ping" times sucked (over half a second), so I'm sure the "gamers" hate
using IPv6.

        Old guy

[toc] | [prev] | [next] | [standalone]

#13538

Moe Trin writes:
> What is quite noticeable now is the size of the chunks being handed
> out.  Two years ago, /12s were not uncommon, and /16s were relatively
> common.  Now, the block issued is more likely to be a /20, /21 or most
> commonly, a /22 (even by LACNIC which had a possibly false reputation
> for being "generous").

Thereby exacerbating the routing table explosion.
-- 
John Hasler 
jhasler@newsguy.com
Dancing Horse Hill
Elmwood, WI USA

[toc] | [prev] | [next] | [standalone]

#13539

On Sun, 01 Feb 2015, in the Usenet newsgroup comp.os.linux.misc, in article
<87d25tvaja.fsf@thumper.dhh.gt.org>, John Hasler wrote:

Moe Trin writes:
>> What is quite noticeable now is the size of the chunks being handed
>> out.  Two years ago, /12s were not uncommon, and /16s were relatively
>> common.  Now, the block issued is more likely to be a /20, /21 or
>> most commonly, a /22

>Thereby exacerbating the routing table explosion.

Things had been headed in that direction since before 2000.   When did
they add 32 bit AS numbers?    Actually, as of Jan 15, there were only
61690 AS numbers allocated/assigned.

Year   IPv4 Nets  IPv4 Addresses   IPv6 Nets  IPv6 Addresses      AS#
1985       1997      360680960          -       (x 10e30)          48
1990       7907      730298112          -        -                403
1995      44077     1374740706          -        -               3340
2000      54938     1698877890         52        1.138905       10297
2005      72599     2246643418       1410     3235.797142       22269
2010     103541     3199907744       6406    11502.056475       41634
2011     113278     3402331040       9943    12689.630209       46637
2012     121338     3483326912      13111    14157.624943       51668
2013     134951     3537428728      17894    10995.648467       56486
2014     144378     3592946296      22138    12628.547759       61801
  available pool    3702324224               4.2535 x10e37  4199933132

Year-end figures.  Source: delegation database files from Afrinic,
APNIC, ARIN, LACNIC and RIPE.   The slump of IPv6 addresses in (March)
2013 resulted from one (Brazilian?) entity returning a /16 which is
5192.3 x 10e30 addresses.    The IPv6 pool is "limited" because IANA has
only released 2::/3 to the RIRs for (global) issue.   But as hinted in
RFC1606, "there's plenty more where that came from."

        Old guy

[toc] | [prev] | [next] | [standalone]

#13540

Moe Trin <ibuprofin@painkiller.example.tld.invalid> wrote:
>Things had been headed in that direction since before 2000.   When did
>they add 32 bit AS numbers? 

In RIPE-Land, they were supported since 2007 and the default since
2009.

Greetings
Marc
-- 
-------------------------------------- !! No courtesy copies, please !! -----
Marc Haber         |   " Questions are the         | Mailadresse im Header
Mannheim, Germany  |     Beginning of Wisdom "     | http://www.zugschlus.de/
Nordisch by Nature | Lt. Worf, TNG "Rightful Heir" | Fon: *49 621 72739834

[toc] | [prev] | [next] | [standalone]

#13531

On 31/01/15 20:37, Moe Trin wrote:

> By then, your ISP will be handing out IPv6 blocks, and the smallest one
> the IETF contemplates being handed out to end customers is a /64 which
> gives you 1.845 x10^19 addresses - that's enough to let you set up 4.29
> billion /96 subnets - each being as large as all IPv4 space. Non-problem.

I have to confess, mine gave me a block many years ago. I got it working 
once to "prove a point" - but for now I've disabled IPv6 on my clients 
as it was causing issues - partly because I don't fully "get" the setup 
and partly because external existence is limited.

One day...

>> Option 2
>
>> 2) My really public stuff (like IPCams, servers, home automation) on /27
>
> Color me paranoid, but does all of that really need to be accessible from
> the world?   Given the current standard of security being displayed by
> the home automation community, I'd be VERY hesitant to make them
> accessible.  (Heck, there is a folded piece of duct-tape covering the
> lens of the built-in camera on the lap-tops, only moved out of the way
> when I intentionally want to use the it,)

I agree with your sentiments - but I really have a hang up about NAT - I 
view it as a very dirty "if needs must" option. Possibly been spoilt, 
working for places with multiple /16 allocations adn zero NATing - but 
whilst I agree that HA and IPCams are notoriously weak, I still prefer 
to work without NAT and limit the damage with firewalls.

It's partly because I cannot assume I will always have a VPN client (the 
classic solution) to hand - so it's a trade off between a bit of 
firewalling and practical easy access. Probably not helped by the few 
VPNs I've been forced to use for work had setups that sucked. For my 
work, I punch a load of ssh tunnels through and it's way easier to work 
with.

>> Con: Certain Internal-Internal traffic gets routed so will bottleneck
>
> Ohhhh, the freeway is narrowing down from 12 lanes in this direction to
> only 11 - that might cause congestion in Los Angeles, but is not likely
> to be a problem in other metropolitan areas.   As your hosts don't all
> have point-to-point connections to all other hosts, you've already got a
> bottleneck in those switches - but I don't see it as a PRACTICAL problem.

Point taken - it WAS a real problem when my router was a Linksys WRT54GS 
- that could only route (or do anything) at 100Mbits. I have an internal 
drive to optimise - perhaps sometimes when it is not full justified - 
I'll admit that.

>> Option 3
>
>> 1) Visitor network on say 10.0.1.x, NATed
>> 2) All my stuff on private, 10.0.0.x NATed
>> 3) Router does IP translation from /27 to 10.0.0.x for public stuff
>
>> Pro: Fast switching for Internal-Internal
>
> Above - there is an insignificant bottleneck
>
>> Con: Needs either split-DNS (have this now, do not like it) OR the
>> router will end up doing reflection-translation for Internal-Internal
>
> I suppose it depends on how dynamic the hosts are.  MOST of my internal
> hosts are fixed (and have fixed addresses/hostnames), and don't go
> "walkies" often enough to worry about.   The truly dynamic stuff is on
> a separate sub-net, but they don't offer services, so a DDNS slaved to
> the DHCP server is sufficient.
>
>> Con: I just don't like it. I am very much pro using public IPs as the
>> Internet originally intended. I hate NAT but it is OK for misc visitor
>> stuff. Prefer to have my regular kit on public IPs and clean.
>
> When the Internet was originally developed, the user community was much
> smaller, more professional, and better behaved.

Yes - indeed. It's sad but inevitable - and the russian IPCam hackery is 
not lost on me...

> While there were
> rather enormous security holes, they were rarely exploited because
> people didn't think of them, and/or had the good sense to not try to
> exploit them.   If you scan the "Risks Digest" (news://comp.risks/), I
> am no longer amazed at the wide-spread lack of common-sense security.
> Why the control computers at the Smithfield Nuclear Power plant need to
> be accessible from the world at large...  so the local stores, bars or
> whatever can upload pictures (and targeted advertisements) of the
> products they are delivering to Homer Simpson for his approval?
>
> Your option 2 (public stuff on the /27, everything else NATed) is likely
> the best choice if you have a lot of public stuff - otherwise, I'd go
> with option 3, which reduces exposure, but at the cost of extra CPU
> cycles on the router doing NAT.  It's probably not a bandwidth issue.

Thank you for your thoughts - All good things to think about...

[toc] | [prev] | [next] | [standalone]

#13537

On Sat, 31 Jan 2015, in the Usenet newsgroup comp.os.linux.misc, in article
<uu50qb-p6c.ln1@squidward.dionic.net>, Tim Watts wrote:

>Moe Trin wrote:

>> By then, your ISP will be handing out IPv6 blocks

>I have to confess, mine gave me a block many years ago. I got it
>working once to "prove a point" - but for now I've disabled IPv6 on my
>clients as it was causing issues - partly because I don't fully "get"
>the setup and partly because external existence is limited.

Mentioned in my reply to Bill - the infrastructure around here is rather
poor. It sort of reminds me of routing in the 1990s, where a connection
from one side of town to another could entail cross-country routes if
the two were not on the same ISP or upstream.

>I agree with your sentiments - but I really have a hang up about NAT -
>I view it as a very dirty "if needs must" option.

NAT or it's equivalent has been the norm for many years.  RFC1918
("Address Allocation for Private Internets") dates from 1996 but it
replaced RFC1597 from two years earlier.  I don't know when address
translation became the big thing (RFC1631 also dates from 1994 and was
built on concepts from late 1992 at Berkeley), but at NASA Ames Research
Center in the 1970s, we'd telnet to a system that had connectivity (I
want to say 1972, but those memories are from a LONG time ago) well
before IP even existed (RFC0791 is September, 1981).   With most dialin
services in the 1980s, the BBS you dialed in to (terminal connection,
much like telnet) was effectively NAT.

>> When the Internet was originally developed, the user community was
>> much smaller, more professional, and better behaved.

>Yes - indeed. It's sad but inevitable - and the russian IPCam hackery
>is not lost on me...

Even into the 1990s, you used to be able to complain to "abuse@ISP.com"
and have someone at least LOOK at the complaint.   This meant the
firewall setup was such that rejected connections were logged, and you
would actually look at the log with some expectation of having the
abuser "punished".    Like many, I gave up on that in the mid-1990s,
when things got out of hand, and many/most/all complaints were answered
by an auto-responder on an ignore-bot.  Last night, I tweaked the
firewall script to include a "LOG" target - the log was 1547 lines
after 29 minutes.   No big deal, as the firewall had already blocked
them - but WTF are they trying to connect to 19/udp (chargen - RFC0864),
22/tcp (who in his right mind has that open to other than 'anonymous'
downloads) or even 9/tcp (RFC0863 "discard"???  WTF, Over!).   I see a
lot of attempts to connect to 16471/udp (the "ZeroAccess" bot peer),
6881/tcp (Bit-Torrent), 9064/tcp (Legato Networker or Sun Solcitice
Backup) from several hosts in Romania, and a single host in the UK
(109.169.45.231) is also making an extreme nuisance of itself trying to
see if I'm offering Skype.   61.160.228.x and 61.240.144.x in China are
also _very_ persistent, and for some reason I'm seeing unsolicited DNS
replies (usually SERVFAIL) from hosts that OTHERWISE don't appear to be
running a DNS (no response to queries on 53/udp _OR_ 53/tcp).

        Old guy

[toc] | [prev] | [standalone]

Back to top | Article view | comp.os.linux.misc

csiph-web