On Sat April 12 2008, John Cornelius wrote: > I gather that it's simply a case of you moving from direct connection to > the Internet to a connection that's behind your Cisco router. I further > presume that the (nominal) 70.x.x.120 address belongs to the Cisco. In > that case you probably don't want to do what you propose. > Thanks for your thoughts, and yes, your surmising is correct > Your box should be set up on the internal LAN subnet in the normal way. > All of the interesting configuration should be done on the Cisco router > by setting up source and destination NAT so that internet traffic on > specific ports addressed to the Cisco are routed to your box and > responses are automatically routed back through the Cisco to their > destination. > I viscerally believe you're correct, here - else why is this the way this is universally done, but I sure could use some better technically grounded expertise in the whys and wherefores > Trying to deal with this issue from inside the LAN rather than in the > router will most likely lead to frustration since whatever you do will > be fragile and probably break often if it works at all. This is where I need better argumentation...if you can help, it would be appreciated. Specific examples of why it's a bad idea, security problems that could occur, other issues...unfortunately, this configuration has been handed to me, it's not my idea, so I need to understand what's wrong with it and be able to offer sound arguments for the more conventional approach, if there's is a really sound technical reason for not doing it this way. I'm also dealing with the fact that another Linux box, a mail server, has been moved on to this new FIOS lan and configured using the hack that I cited in my original post, and is working quite nicely - unfortunately, I don't clearly understand how to implement that hack on Fedora, but, I'm getting the "if Jack could do this with his Debian box, why can't you with your Fedora?".... -- Claude Jones Brunswick, MD, USA
