network setup advice sought
Shane Faulkner
TCP/IP...
My company has a small network of about 10 Windoze PCs,
and 1 SCO Unix 5.0.5 Enterprise server.
The network (which I inherited) was setup poorly regarding
IP addresses. "Who cares, we'll never be connected
directly to the 'net". Well...
We were just assigned a block of 20 IP addresses and now
have a DSL modem wired from our ISP to our hub. Ideally,
I'd like to use this block of IP addresses only on the
Windoze PCs and keep the SCO server off the internet
completely. I'm assuming as long as I don't:
a) give the SCO server one of these IP addresses
b) don't add a route on the SCO server to the gateway
that I'll be protecting it from net access.
By doing this, however, I don't think I'll be able to
access the SCO server via telnet or ftp internally since
the IP addresses of the client PCs and SCO server will
be on different subnets (?) and the gateway on all the
Windoze PCs will point to our ISP's gateway machine.
I checked out some of Tony Lawrence's excellent articles
on his website regarding TCP/IP and security, and I
will head down the path of tcp-wrappers if that's the
best alternative. I was just hoping for some advice
on my particular situation.
TIA,
Shane.
Jeff Liebermann
<ak...@freenet.buffalo.edu> wrote:
>We were just assigned a block of 20 IP addresses and now
>have a DSL modem wired from our ISP to our hub. Ideally,
>I'd like to use this block of IP addresses only on the
>Windoze PCs and keep the SCO server off the internet
>completely.
Rediculous. That means you'll have to protect each machine with
individual firewalls. It also means that you'll be "borrowing"
someones routeable IP address for the OSR5 machine which is uncool.
It also means that the OSR5 machine can never be seen from the
interknot meaning that it can't be used as a mail server or for remote
maintenance. Lousy idea. Get a firewall and put EVERYTHING in your
block of 20 IP's.
Incidentally, 20 IP's is usually insufficient for anything useful.
It's usually the print servers and web configurable devices (fax
machines, copiers) that run you out of IP's. Think NAT.
>I'm assuming as long as I don't:
>a) give the SCO server one of these IP addresses
>b) don't add a route on the SCO server to the gateway
>that I'll be protecting it from net access.
Protection by crippling?
>By doing this, however, I don't think I'll be able to
>access the SCO server via telnet or ftp internally since
>the IP addresses of the client PCs and SCO server will
>be on different subnets (?) and the gateway on all the
>Windoze PCs will point to our ISP's gateway machine.
Wrong. You can add a static route to all of the Windoze boxes with
the "route add ..." command. Open an MSDOS box window and run:
route print
to see the current routes and how they work.
>I checked out some of Tony Lawrence's excellent articles
>on his website regarding TCP/IP and security, and I
>will head down the path of tcp-wrappers if that's the
>best alternative. I was just hoping for some advice
>on my particular situation.
Huh? If your OSR5 box is invisible to the internet, you don't need
tcp wrappers and IP filters (TLS711). IP filters are only useful for:
1. Protecting an OSR5 machine from the interknot.
2. Setting up the OSR5 box as an internet gateway and firewall where
you windoze boxes go *THRU* the OSR5 box to get to the internet. Since
you'r proposing to do neither of these, neither tcp wrappers or IP
filters will do anything.
There are about a zillion ways to do this including with and without
NAT (network address translation). I'll itemize without detail as I'm
too lazy to explain them all.
1. If your unspecified DSL modem just happens have firewall software
available, use it. (i.e. Flowpoint 2200 firewall software is free)
2. Buy a Sonicwall/50 and use it as a firewall between the
unspecified DSL modem and the rest of the network. Other, cheaper
firewalls will also work (Linksys BEFR11).
3. Use the OSR5 box as a firewall and gateway (add a 2nd ethernet
card). Use TLS711 (IP Filter) for packet filtering. Windoze boxes
connect THRU the OSR5 box.
4. Same as above with the added enjoyment of NAT (network address
translation) using TLS709. This requires only one IP address to the
internet and allows up to 254 machines on your LAN.
There are more but it's too hot to think.
Also, you'll need to do some work changing the IP address of the OSR5
box. See:
http://www.cruzio.com/~jeffl/sco/new_name.txt
for clues.
--
Jeff Liebermann je...@comix.santa-cruz.ca.us
150 Felker St #D Santa Cruz CA 95060
831-421-6491 pager 831-429-1240 fax
http://www.cruzio.com/~jeffl/sco/ SCO stuff
da Bomb
Cable/DSL connections. I thought I was OK when I first got DSL, then I
started noticing files in my shared drives. Then I got htis message I was
part of some global processor farm. I got a D-Link DI-701 it's for home
use, but it can support up to 128 users. For Business, I'd suggest a
Sonicwall SOHO/50, Netopia 9100, or Netgear RT311. NAT is the way to go
especially if you have DSL in your home or office.
Also, all the devices can be set up to be a DHCP server, so all you have to
do is use DHCP on all of your systems except for the servers and printers.
Peace!
dB
Doug Satterfield
setup for a customer.
If the Tele Co. installs a router can I still use ipnat and ipfilter for
the access and firewall?
If I install a 2nd NIC in the SCO server, can I use a DHCP client for 1 NIC
and static for the other, and omit the router and use ipnat and ipfilter?
How does one telnet into the server thru the net? Does the site have to
have a static IP and use the router had to support NAT on the router?
Thanks
Doug Satterfield do...@satterfieldusa.com
Satterfield Computer Services
PO Box 488
White Rock, SC 29177
Jeff Liebermann <je...@comix.santa-cruz.ca.us> wrote in message
news:pmncks8kot69nctru...@4ax.com...
Jeff Liebermann
<do...@satterfieldusa.com> wrote:
>A couple of questions concerning this network, I am looking into this same
>setup for a customer.
In reality, no two network setups are exactly the same.
>If the Tele Co. installs a router can I still use ipnat and ipfilter for
>the access and firewall?
The telephone company does not install a router. They install an ISDN
line, DS0, ADSL, SDSL, T1, etc line. That's 2 or 4 wires and not much
else. In some cases, they supply an xDSL "modem". You supply the
router and sometimes the modem or CSU/DSU.
Routers come in a wide variety of configurations. However, they all
have a common characteristic. They control packets between the WAN
(wide area network) side, and the LAN (local area network) side of the
router. The router inspects the IP headers and decides who shall
pass, who shall be NAT translated, who shall be dropped, and sometimes
sniff the payload.
If the router has a built in firewall, you don't need IPfilters. If
the router does NAT, you don't need IPNAT. If your router has
neither, then both will need to be provided on the OSR5 box. In this
case, a 2nd NIC card will need to be installed on the OSR5 box. As
you may notice, the exact topology depends largely on the model of
router.
Whatever you do, don't do NAT on both the first router and the OSR5
box.
>If I install a 2nd NIC in the SCO server, can I use a DHCP client for 1 NIC
>and static for the other, and omit the router and use ipnat and ipfilter?
I don't understand the question. Adding the 2nd NIC to the OSR5 box
turns the OSR5 box into a router with WAN and LAN sides. Where the IP
addresses come from make no difference. IPNat and IPFilters are part
of TLS711, while DHCP client is TLS709. Different packages. If your
ISP delivers its addresses via DHCP, then the first router will need
to be running DHCP to get an IP address. If what you call a router is
actually an xDSL modem, that requires no IP address to operate, then
the DHCP client can be running on the OSR5 box. The 2nd NIC should be
static as this will be the default gateway for your internal LAN and
should not change.
>How does one telnet into the server thru the net?
If NAT is running on the first router, then you need to punch a hole
in the firewall. Assuming you have NAT running, you need to
translate:
WAN_IP_address:23 ---> OSR5_box_LAN_IP_address:23
Port 23 is the telnet port. Everything that goes to port 23(telnet)
from the WAN (internet) goes to the OSR5 box on port 23.
If the first router is actually a modem (no NAT) and you're running
NAT on the OSR5 box, then just telnet to the server IP. However, I
would recommend using secure shell (SSH).
>Does the site have to
>have a static IP and use the router had to support NAT on the router?
No. NAT will work just fine with a dynamic IP on the WAN end. The
problem is that you can't easily run mail, web, or ftp servers or use
a domain name without a fixed IP addresses and fulltime connection.
There are some ways for dealing with moving target IP's and domain
names.
http://www.dyndns.com
I've used them with Linux, but not OSR5. Another potential problem is
PPPoE, the new dynamic IP protocol from hell. No OSR5 support at this
time.
Next time, how about a clue as to what you're trying to accomplish and
what you have to work with?
Doug Satterfield
OSR 5.0.5a, (10.0.0.5) NT Terminal Server, (10.0.0.2) 15 PC's on LAN static
IP addresses 10.0.0.10 - 25).
Main router at host site (10.0.0.1).
2 (remote sites on frame relay connection, 56K data lines working fine
couple of PC's each. Net IP 172.16.110.X, 172.16.120.X
I want to install high speed internet access at the host site and have all 3
locations use it for Internet access and mail.
In the remote routers I will set a default route to the Internet router (be
it true router, or OSR 5 with NAT & IPfilter)
Jeff Liebermann <je...@comix.santa-cruz.ca.us> wrote in message
news:otvgkskr55l8nmkpc...@4ax.com...
>On Wed, 14 Jun 2000 21:52:53 -0400, "Doug Satterfield"
><do...@satterfieldusa.com> wrote:
>
>>A couple of questions concerning this network, I am looking into this same
>>setup for a customer.
>
>In reality, no two network setups are exactly the same.
Same theory, different config.
>>If the Tele Co. installs a router can I still use ipnat and ipfilter for
>>the access and firewall?
>
>The telephone company does not install a router. They install an ISDN
>line, DS0, ADSL, SDSL, T1, etc line. That's 2 or 4 wires and not much
>else. In some cases, they supply an xDSL "modem". You supply the
>router and sometimes the modem or CSU/DSU.
In my case the Telephone company can install a ADSL modem and a router if
desired. I am trying to decide which would be the best approach. I don't
know yet if they support NAT on their router.
>Routers come in a wide variety of configurations. However, they all
>have a common characteristic. They control packets between the WAN
>(wide area network) side, and the LAN (local area network) side of the
>router. The router inspects the IP headers and decides who shall
>pass, who shall be NAT translated, who shall be dropped, and sometimes
>sniff the payload.
>
>If the router has a built in firewall, you don't need IPfilters. If
>the router does NAT, you don't need IPNAT. If your router has
>neither, then both will need to be provided on the OSR5 box. In this
>case, a 2nd NIC card will need to be installed on the OSR5 box. As
>you may notice, the exact topology depends largely on the model of
>router.
>
>Whatever you do, don't do NAT on both the first router and the OSR5
>box.
I understand that. A 2nd NIC is required if the OSR box is the router. If
the true router has no firewall and I want to use it anyway, can the OSR box
still provide the IP filtering?
>>If I install a 2nd NIC in the SCO server, can I use a DHCP client for 1
NIC
>>and static for the other, and omit the router and use ipnat and ipfilter?
If I connect the OSR box directly to the DSL modem then my system becomes
the router. If the Telephone Co uses DHCP to assign an IP, (which they do),
my 1st NIC for the internal LAN uses a static IP (10.0.0.5). The NIC
attached to the DSL modem would use the DHCP client. On OSR 5.0.5, is this
do-able? I have set up other systems with a PPP dialup connection to their
ISP and used NAT and it works well. I assume this is the same concept but
different.
I was informed that I would need a static IP. If the IP is dynamic, how do
you know how to telnet into it? Assume you are remote and dialed into your
local ISP. How do you tell your system (or notebook PC in this case) where
to telnet into if the IP is dynamic? I know you have to translate it but
something on your local system has to know the real IP in order to be routed
to it. PPTP?
> http://www.dyndns.com
>I've used them with Linux, but not OSR5. Another potential problem is
>PPPoE, the new dynamic IP protocol from hell. No OSR5 support at this
>time.
>
>Next time, how about a clue as to what you're trying to accomplish and
>what you have to work with?
I'm trying. Right now I want to understand the theory. Until I have
actually suffered thru the 1st install it is all a bit cloudy. Before I can
propose this to my client, I have to understand it.
Doug Satterfield do...@satterfieldusa.com
Jeff Liebermann
<do...@satterfieldusa.com> wrote:
>OSR 5.0.5a, (10.0.0.5) NT Terminal Server, (10.0.0.2) 15 PC's on LAN static
>IP addresses 10.0.0.10 - 25).
>Main router at host site (10.0.0.1).
>2 (remote sites on frame relay connection, 56K data lines working fine
>couple of PC's each. Net IP 172.16.110.X, 172.16.120.X
>I want to install high speed internet access at the host site and have all 3
>locations use it for Internet access and mail.
>In the remote routers I will set a default route to the Internet router (be
>it true router, or OSR 5 with NAT & IPfilter)
Drivel: I'll spare you my comments about using two different
non-routeable blocks of IP addresses. There's no reason the remote
sites couldn't have shared the 10.x.x.x block.
Plan A: OSR5 box acts as router, firewall, NAT, DHCP client.
Add 2nd NIC to OSR5 box. Install TLS709 for DHCP, TLS711 for NAT and
IPFilters. Phone company installs a brain dead DSL modem/bridge which
connects to 2nd NIC. DHCP client gets IP address from telco ISP. NAT
translates this one IP address to the 10.0.0.xxx Class C IP block on
the first NIC. IPFilters controls traffic between the two NIC's.
Plan B: External hardware router, firewall, NAT, DHCP client.
OSR5 box does nothing unusual and requires no added software or NIC.
Customer purchases overpriced Cisco router or cheap junk ethernet
router (Netgear, Linksys, D-Link, Netopia, etc). Telco supplies brain
dead DSL modem/bridge. All router, firewall, NAT, DHCP, etc functions
are resident in the hardware router. This may be required if DSL
service provider delivers dynamic IP address via PPPoE as OSR5
currently does not have a PPPoE dialer while most cheap junk ethernet
hardware routers have this feature.
There are also variations on the above extremes, where some services
are resident on the OSR5 box, and others inside the router. I don't
wanna get into the various combinations and permutations. In all
cases, methinks this is a rotten idea as it drastically increases
complexity and requires both the 2nd NIC in the OSR5 box and a
hardware external router. The basic decision is whether you want the
OSR5 box to do the job, or an external router.
Methinks you might want to do some reading on available technology,
hardware, topology, and DSL offerings. There are lots of options and
complications. For example, you *MUST* increase the IP maximum
receive window on all your internal boxes to 32768 (from 4K or 4K),
including your OSR5 box, or you will get rotten download performance.
Navas Cable Modem/DSL Tuning Guide
http://Cable-DSL.home.att.net/
DLSReports
http://www.dslreports.com
>In my case the Telephone company can install a ADSL modem and a router if
>desired. I am trying to decide which would be the best approach. I don't
>know yet if they support NAT on their router.
ALL modern routers support NAT. If it really routes (i.e. inspects
packet headers) then it can do NAT. Get the model numbers they offer
to be sure.
There are routers with built in modems (Cayman 3220H). The local
telcos will supply only the modem for free and want extra $$$ for the
combo router+modem boxes. I'm partial to seperating the functions in
two boxes because:
1. PacHell delivers 5 IP addresses to me via a single ADSL line.
2. Each of the 5 IP's go to 5 different routers and 5 different
companies. Each company/router gets it's own IP.
This cannot be done with an integrated router/modem. It's also
proscribed by some of the "personal" DSL services. I can supply
details on this derrangement if you're interested. I would go with
the external modem and seperate router for flexibility reasons.
>I understand that. A 2nd NIC is required if the OSR box is the router. If
>the true router has no firewall and I want to use it anyway, can the OSR box
>still provide the IP filtering?
Let me make my life easy. No way in hell should you be using two
routers. Either OSR5 or external hardware does the routeing, not
both. The only justification for having two routers is to build a DMZ
(demilitarized zone) system, where a dedicated mail server and
possibly a bastion host sits exposed in the DMZ, while your internal
LAN is hidden by the 2nd router. This is the recommended high
security method for large companies. Often the 2nd router is also a
proxy server offering yet another level of security and complexity.
In this case, methinks you can always add complexity at a later date.
Keep it simple for now, and just have one router.
You will not find a "true router" that does not also support NAT and
some kind of firewall. The firewall may be incredibly crude as in the
Linksys and D-Link products, but it is quite effective. Once you have
NAT enabled somewhere, that box needs to "sniff" the packet payload
for certain protocols to function. Sniffing ftp is universal, but
some of the goofier protocols (H.323, netmeeting, ICQ chat, real
audio, certain games) that open random IP socket numbers and carry IP
addresses in the data stream instead of the header, require imbedded
NAT support. For a list of potential problem applications, see:
http://cco.cisco.com/warp/public/701/60.html#HDT3
Note the Cisco correctly distinguishes between NAT (network address
translation) and PAT (port address translation). TLS711 and all of
the cheap routers actually do PAT. Go through the list of problem
applications and see if any apply.
I bet you thought this was gonna be simple?
>If I connect the OSR box directly to the DSL modem then my system becomes
>the router. If the Telephone Co uses DHCP to assign an IP, (which they do),
>my 1st NIC for the internal LAN uses a static IP (10.0.0.5). The NIC
>attached to the DSL modem would use the DHCP client. On OSR 5.0.5, is this
>do-able? I have set up other systems with a PPP dialup connection to their
>ISP and used NAT and it works well. I assume this is the same concept but
>different.
Yep. This is a good description of Plan A. Basically, OSR5 does
everything. As long as you either have a fixed IP, or a DHCP
delivered IP, this will work. No PPPoE support yet. Methinks the
term "modem" is a bit confusing. DSL modem are essentially brain
dead. There's some intelligence about setting up PVC's permanent
virtual circuits and ATM bridging, but that's all set and forget. All
the modem really does is do the modulation/demodulation on the phone
line, and deliver an ethernet (IP over ATM) connection. It's not like
the traditional dialup modems which require an ordeal process to
function. The better modems provide line quality statistics and SNMP,
but those can be ignored. Think of it as the phone company supplying
you an ethernet jack, which belches whatever the DSLAM at the switch
decides is appropriate. Unfortunately, with PPPoE, we return to the
good olde daze of dialup and actually "dial" the ISP with DSL. See:
http://www.carricksolutions.com/pppoe.htm
for why I hate PPPoE. Avoid if possible.
>I was informed that I would need a static IP.
Static IP's make life MUCH simpler. If you can afford it, do it.
>If the IP is dynamic, how do
>you know how to telnet into it?
1. Use a dynamic DNS service. http://www.dyndns.com
2. Every time your DSL connects, ftp a file with your IP address to a
known location on the net. Users read the file, and use that IP
address. I do this with my dialup connections.
3. Port scan the block of IP addresses likely to be your server.
This is a great way to make yourself unpopular with your ISP and other
users. It's also a violation of most terms-o-service. But, it works.
4. Bring up your link at least once during the DHCP lease time. This
is called IP hogging. Essentially, you're extending your lease time.
Most of the local DHCP driven DSL ISP have 3 day leases. One of my
users on DHCP has had the same IP for about 6 months.
5. Find someone that's running a Dynamic DNS (DDNS) server on the net
and pay them to host your continuously changing DNS record. This only
works marginally because the ISP's DNS caches are often not flushed or
updated for days.
>I'm trying. Right now I want to understand the theory. Until I have
>actually suffered thru the 1st install it is all a bit cloudy. Before I can
>propose this to my client, I have to understand it.
Yeah, I know the feeling. That which I do not understand, usually
turns around and bites me.
Doug Satterfield
>On Thu, 15 Jun 2000 08:22:39 -0400, "Doug Satterfield"
><do...@satterfieldusa.com> wrote:
>
>>OSR 5.0.5a, (10.0.0.5) NT Terminal Server, (10.0.0.2) 15 PC's on LAN
static
>>IP addresses 10.0.0.10 - 25).
>>Main router at host site (10.0.0.1).
>>2 (remote sites on frame relay connection, 56K data lines working fine
>>couple of PC's each. Net IP 172.16.110.X, 172.16.120.X
>>I want to install high speed internet access at the host site and have all
3
>>locations use it for Internet access and mail.
>>In the remote routers I will set a default route to the Internet router
(be
>>it true router, or OSR 5 with NAT & IPfilter)
>
>Drivel: I'll spare you my comments about using two different
>non-routeable blocks of IP addresses. There's no reason the remote
>sites couldn't have shared the 10.x.x.x block.
I know, long story, another day.
>Plan A: OSR5 box acts as router, firewall, NAT, DHCP client.
>Add 2nd NIC to OSR5 box. Install TLS709 for DHCP, TLS711 for NAT and
>IPFilters. Phone company installs a brain dead DSL modem/bridge which
>connects to 2nd NIC. DHCP client gets IP address from telco ISP. NAT
>translates this one IP address to the 10.0.0.xxx Class C IP block on
>the first NIC. IPFilters controls traffic between the two NIC's.
>
>Plan B: External hardware router, firewall, NAT, DHCP client.
>OSR5 box does nothing unusual and requires no added software or NIC.
>Customer purchases overpriced Cisco router or cheap junk ethernet
>router (Netgear, Linksys, D-Link, Netopia, etc). Telco supplies brain
>dead DSL modem/bridge. All router, firewall, NAT, DHCP, etc functions
>are resident in the hardware router. This may be required if DSL
>service provider delivers dynamic IP address via PPPoE as OSR5
>currently does not have a PPPoE dialer while most cheap junk ethernet
>hardware routers have this feature.
Got It. I don'y know the brand of router yet, but I will find out.
>Methinks you might want to do some reading on available technology,
>hardware, topology, and DSL offerings. There are lots of options and
>complications. For example, you *MUST* increase the IP maximum
>receive window on all your internal boxes to 32768 (from 4K or 4K),
>including your OSR5 box, or you will get rotten download performance.
>
>Navas Cable Modem/DSL Tuning Guide
> http://Cable-DSL.home.att.net/
>DLSReports
> http://www.dslreports.com
I could not agree more. I hope I am not the only person trying to make
sense of this stuff.
>>In my case the Telephone company can install a ADSL modem and a router if
>>desired. I am trying to decide which would be the best approach. I don't
>>know yet if they support NAT on their router.
>
>ALL modern routers support NAT. If it really routes (i.e. inspects
>packet headers) then it can do NAT. Get the model numbers they offer
>to be sure.
OK
>There are routers with built in modems (Cayman 3220H). The local
>telcos will supply only the modem for free and want extra $$$ for the
>combo router+modem boxes. I'm partial to seperating the functions in
>two boxes because:
>1. PacHell delivers 5 IP addresses to me via a single ADSL line.
>2. Each of the 5 IP's go to 5 different routers and 5 different
>companies. Each company/router gets it's own IP.
>
>This cannot be done with an integrated router/modem. It's also
>proscribed by some of the "personal" DSL services. I can supply
>details on this derrangement if you're interested. I would go with
>the external modem and seperate router for flexibility reasons.
Telco installs a DSL modem and a separate router. I would like the details.
I support several offices in the same building and it sounds like something
I should be looking into.
>>I understand that. A 2nd NIC is required if the OSR box is the router.
If
>>the true router has no firewall and I want to use it anyway, can the OSR
box
>>still provide the IP filtering?
>
>Let me make my life easy. No way in hell should you be using two
>routers. Either OSR5 or external hardware does the routeing, not
>both. The only justification for having two routers is to build a DMZ
>(demilitarized zone) system, where a dedicated mail server and
>possibly a bastion host sits exposed in the DMZ, while your internal
>LAN is hidden by the 2nd router. This is the recommended high
>security method for large companies. Often the 2nd router is also a
>proxy server offering yet another level of security and complexity.
>In this case, methinks you can always add complexity at a later date.
>Keep it simple for now, and just have one router.
I am leaning towards SCO as the router. It keeps it alive instead of being
replaced totally by NT.
>You will not find a "true router" that does not also support NAT and
>some kind of firewall. The firewall may be incredibly crude as in the
>Linksys and D-Link products, but it is quite effective. Once you have
>NAT enabled somewhere, that box needs to "sniff" the packet payload
>for certain protocols to function. Sniffing ftp is universal, but
>some of the goofier protocols (H.323, netmeeting, ICQ chat, real
>audio, certain games) that open random IP socket numbers and carry IP
>addresses in the data stream instead of the header, require imbedded
>NAT support. For a list of potential problem applications, see:
> http://cco.cisco.com/warp/public/701/60.html#HDT3
>Note the Cisco correctly distinguishes between NAT (network address
>translation) and PAT (port address translation). TLS711 and all of
>the cheap routers actually do PAT. Go through the list of problem
>applications and see if any apply.
>
>I bet you thought this was gonna be simple?
Nothing is ever simple and everything takes longer that anticipated.
I don't have PPPoE.
>>I was informed that I would need a static IP.
>
>Static IP's make life MUCH simpler. If you can afford it, do it.
>
>>If the IP is dynamic, how do
>>you know how to telnet into it?
>
>1. Use a dynamic DNS service. http://www.dyndns.com
>2. Every time your DSL connects, ftp a file with your IP address to a
>known location on the net. Users read the file, and use that IP
>address. I do this with my dialup connections.
>3. Port scan the block of IP addresses likely to be your server.
>This is a great way to make yourself unpopular with your ISP and other
>users. It's also a violation of most terms-o-service. But, it works.
>4. Bring up your link at least once during the DHCP lease time. This
>is called IP hogging. Essentially, you're extending your lease time.
>Most of the local DHCP driven DSL ISP have 3 day leases. One of my
>users on DHCP has had the same IP for about 6 months.
>5. Find someone that's running a Dynamic DNS (DDNS) server on the net
>and pay them to host your continuously changing DNS record. This only
>works marginally because the ISP's DNS caches are often not flushed or
>updated for days.
Sounds like a cron job.
>>I'm trying. Right now I want to understand the theory. Until I have
>>actually suffered thru the 1st install it is all a bit cloudy. Before I
can
>>propose this to my client, I have to understand it.
>
>Yeah, I know the feeling. That which I do not understand, usually
>turns around and bites me.
>
>--
>Jeff Liebermann je...@comix.santa-cruz.ca.us
>150 Felker St #D Santa Cruz CA 95060
>831-421-6491 pager 831-429-1240 fax
>http://www.cruzio.com/~jeffl/sco/ SCO stuff
Jeff, Thanks a million. I feel I have enough confidence to jump into this
and see how well it flies. I have been working with nat and ipfilter on the
ppp0 and DSL seems to be the same thing only different.
Doug Satterfield do...@satterfieldusa.com
Satterfield Computer Services
PO Box 488
White Rock, Sc 29177