Firewall needed behind router?

X-No-Archive: Yes

Well, my setup can do it and do it well. Its just a matter of telling the firewall not to let the socks proxy use port 80, and ports 1000-5300. I am simply going on what I was taught in college. We were taught to do it all using software.

Well, actually, each computer would be in sets of 254 computers for each subnet. Routers, gateway programs, and the like only can support 254 computers each. If you have thousands of computers, you must have several routers or several nick cards to do it.

Sure, there class A, B, anc C subnets. Class C, the most common, supports up to 254 machines (addresses 0 and 1 are reserved).

"Charles Newman" wrote in news: snipped-for-privacy@comcast.com:

Thanks for thr info.

I am using a WatchGuard Firebox SOHO 6 firewall appliance that does evreything I need it to do.

Duane :)

by your astronomy instructor if I recall correctly. Any serious business doesn't use the toy firewalls, because the users can override them. Also the "personal" firewalls don't scale. I hope that was an overview class you took, because otherwise I'd recommend filing suit for fraud against the school.

Pay particular attention to the last one. Any idea why we might be using a mask of 255.255.252.0 (/22 or FFFFFC00) which is 1022 hosts on one wire.

The normal use would be routers - we're using Ciscos with up to sixteen interfaces per. You could use a PC with multiple NICs, but they tend to run out of bandwidth pretty quick - even if you put multiple interface NICs like the DLink DFE-570TX or DFE-580TX (four NICs on a single PCI card) or the many different dual NICs. Again, you don't use toy setups for serious business.

Class A, B, C, D, and E went out of fashion in 1993. See

When a Regional Internet Registry like AFRINIC, APNIC, ARIN, LACNIC or RIPE (or a national registry within your country of registration, or even a major provider like BBN, AT&T, Level3, or MCI) assigns you a block of addresses, you can subnet it as you see fit, subject to the recommendations on RFC1219. Our primary block was assigned to us in 1986, and it was divided into /22s based on the expected number of computers in a department.

And if you read RFC1878, you'll discover and you made another error about 'addresses 0 and 1 are reserved'.

Old guy

It works also in the body. Many people put it in the body so that follow-ups, that quote them, won't be archived either.

Hmmm, I cannot find X-No-Archive articles I posted in google.com but I could find yours, so I would guess it is not working.

X-No-Archive: Yes

It is something supported by Google Grouops. Most newsreding software (for windows anyway) wont let you edit the headers directly, so Google modified their system to recognize that anywhere in the message. When it sees that, it will delete the post 6 days after it is first received. When Google receives this message in the news stream, and sees the XNA in the body of the message, it will be flagged for deletion 6 days after it is first received.

The follow-ups will be archived, but the original message with XNA wont. The XNA in the body cannot be preceded by any other character.

Like I say, it cannot have any othe character in front of it. Also, Google is the only news server in the world that recognizes XNA

My firewall is NOT a "toy" the PFW sits on the gateway machine and everything behind it is firewalled. The only way to override the PFW would be to be able to gain access to the gateway machine itself. If any business using a software firewall on a gateway machine keeps that machine in a locked room accessiable only to authorized personnel, then they should be ok.

It would seem you would need more than that to host that many machines on one nic card, becuase

D and E? When I took a networking class in

recommendations

Well, Microsoft and AllegroSurf both reserve 0 and

The XNA is suppose to be in the header, not the body of the message.

I am going on what they taught me in networking class in college in 1999. We were taught everything you ever wanted to know about Microsoft Networking. That is becuase Microsoft dominated the computing world back then and still does today. Windows runs more than 95 percent of the world's computers.

Au contraire.

While it is true that the XNA situation arose back in Deja News days and Google picked up on the custom when it assumed the archives and evolved into their current 6 day policy, there are several different archive types of headerlines and standard practices for managing them.

Gmane's policies are a good example.

ROTFLMFAO! *NO* Mr Newman, as with your fanboi appraisalof evidence eliminator, you couldn't be more wrong if you tried.

No Mr Newman you do not.

That information Mr Newman is over a decade out of date.

May I suggest getting your networking knowledge to the level such that you can read *and* understand what's in RFC1519 before embarrassing yourself further.

Greg

Clues available here:

Charles, the P stands for 'personal', not the laughable 'professional' (have you ever seen _any_ people who make their living in a trade using a product labeled or advertised as "Professional"?).

See those RFCs - 255.255.252.0 (/22 or FFFFFC00) is a lot more common than you can imagine.

"a networking class in 1999" - think about that. Oh, and how much experience do you have? If someone was still teaching Class (A-E) in

What's that? You plug in the computer, turn it on, and it works. Microsoft borged the Apple Rendezvous because setting up networking is so hard. And it's even somewhat secure because it's non-routable, just like the "NETBEUI" protocol they used in WfW and NT before they realized the world wasn't so stupid as to use a protocol that intentionally avoided security because it got in the way. Microsoft transitioned to TCP/IP in NT 3.51 only thirteen years after everyone else. I must admit with this Apple protocol microsoft is using that I've never seen a "Security Considerations" section in an RFC so large and containing so many dire warnings before, but people who use Microsoft networking aren't going to read it anyway.

And this is important exactly how?

And you're surprised by this?

They're just responding to the highly insecure services that are built in to windoze to make it "easy to use".

Uhuh. You really want to re-read those books and RFCs. Even microsoft wouldn't make that big of a mistake.

Old guy

No you were not. There is no reputable networking course I know of which would have *not* thought VLSM/CIDR in 1999, it was old hat by then.

Irrelevant, one does not escape from needing to know about VLSM & CIDR just because the IP stack is written in Redmond.

An idiotic non sequitur which has absolute SFA to do with your lamentable grasp of networking fundamentals.

They do have their own buit-in router, ICS, though I do find third party software to be much more secure as not as vulerable to attack as the Microsoft ICS program

X-No-Archive: Yes

Well, like I say, I have switched to using third-party software, such as AllegroSurf. I find that it is not as vulnerable to attack as Microsoft ICS. If you do use a Microsoft Windows server, do use a third-party program, such as AllegroSurf, you will find your system not as vulnerable. While I still get the rare malware infection, my network is much more secure with ProxyPro, AllegroSurf, or Wingate, than it us using native Microsoft Internet Connection Sharing (ICS). Most worms take advantage of flaws in ICS, which do not exist in third-party products

I really do want to know the name of this college. It sounds more like a MCSP class taught at Office Depot than anything a reputable school would teach.

of which most are running at home (and badly infected), very few are servers because of massive security problems built into the O/S, fewer still are Internet facing, and only a few do more than perfunctory IP networking. By the way, your 95 percent figure is advertising copy unrelated to facts. You could find more accurate figures if you used your search engine instead of parroting half remembered course material.

Microsoft got into TCP/IP thirteen YEARS behind the crowd. With the rest of the world thirteen years ahead of them, they _could_ have learned from the vast experience - but no - microsoft follows standards (including their own) like an elephant follows migrating whales - it really can happen by chance, but the chances are very poor, and microsoft usually goes out of it's way to avoid this if at all possible. The result is a pirated network stack based on Berkeley code, but otherwise butchered.

Old guy