OT: curious about eth0/eth1

OT: curious about eth0/eth1

[Tommy McNeely]

I am curious about why people choose to make a certain interface internal 
or external...

I have always made my "eth0" interface my inside interface.. and once I 
have the box UP and RUNNING (and firewalled), then bring up my outside 
interface "eth1" ... My primary network for smb/nfs/whatever is my inside 
network (thus eth0)... The outside interface is just a "extra interface" 
that I can add on (or move/change/delete) or even make it ppp0 if I happen 
to be changing ISP's :)

I notice several people pick eth0 as their outside interface, and sorta "oh 
yea" the rest of the inside network is on eth1.  I know the linux kernel 
could really care less what they are called, its mostly a "neatness" thing 
I guess... Also it seems like that leaves your box open to attack from the 
time it installs (if you do a NET based install) till the time you get 
around to actually putting a firewall on it.

Again.. I am just curious as to why some do it one way.. and some the 
other... the above is only MY opinion, and could be dreadfully wrong :)

Tommy



--
Tommy McNeely         --        Tommy.McNeely@Sun.COM
Sun Microsystems - IT Ops - Broomfield Campus Support
Phone:  x50888 / 303-464-4888  --  Fax:  720-566-3168

Re: OT: curious about eth0/eth1

[Joel Newkirk]

On Tuesday 07 January 2003 06:59 pm, Tommy McNeely wrote:
> I am curious about why people choose to make a certain interface
> internal or external...

> I notice several people pick eth0 as their outside interface, and
> sorta "oh yea" the rest of the inside network is on eth1.  I know the
> linux kernel could really care less what they are called, its mostly a
> "neatness" thing I guess... Also it seems like that leaves your box
> open to attack from the time it installs (if you do a NET based
> install) till the time you get around to actually putting a firewall
> on it.

Why would this in particular leave a box exposed?

I think that the main reason for 'some one way, some the other' is random 
chance.  However, consider this scenario:

You have two NICs, eth0 and eth1. The connections on one you trust (-i 
eth0 -j ACCEPT), the other you don't.  One of them fails, or the board 
works loose from it's socket, or something, so that upon booting the 
machine you only have one interface.  No matter which board fails, the 
remaining board would be eth0.  If eth0 is your 'trusted' internal 
network in normal conditions, and it fails, then suddenly the untrusted 
network is operating under the trusted network's rules.  However, the IP 
assignment (if static!) would remain that of the trusted network, so as 
long as eth0 is configured with a static IP this shouldn't present a 
risk.  If, however, both are dynamic, (say DHCP assigned) then this 
would qualify as a security hole, possibly a huge one.  To be fair, this 
is probably a very rare intersection of situations, but if eth0 is the 
untrusted network, then any failure would be an annoyance, not a risk.

j

Re: OT: curious about eth0/eth1

[Arnt Karlsen]

On Tue, 7 Jan 2003 22:47:24 -0500, 
Joel Newkirk <netfilter@newkirk.us> wrote in message 
<200301072247.24369.netfilter@newkirk.us>:

> On Tuesday 07 January 2003 06:59 pm, Tommy McNeely wrote:
> > I am curious about why people choose to make a certain interface
> > internal or external...
> 
> > I notice several people pick eth0 as their outside interface, and
> > sorta "oh yea" the rest of the inside network is on eth1.  I know
> > the linux kernel could really care less what they are called, its
> > mostly a"neatness" thing I guess... Also it seems like that leaves
> > your box open to attack from the time it installs (if you do a NET
> > based install) till the time you get around to actually putting a
> > firewall on it.
> 
> Why would this in particular leave a box exposed?
> 
> I think that the main reason for 'some one way, some the other' is
> random chance.  However, consider this scenario:
> 
> You have two NICs, eth0 and eth1. The connections on one you trust (-i
> 
> eth0 -j ACCEPT), the other you don't.  One of them fails, or the board
> 
> works loose from it's socket, or something, so that upon booting the 
> machine you only have one interface.  No matter which board fails, the
> 
> remaining board would be eth0.  If eth0 is your 'trusted' internal 
> network in normal conditions, and it fails, then suddenly the
> untrusted network is operating under the trusted network's rules. 
> However, the IP assignment (if static!) would remain that of the
> trusted network, so as long as eth0 is configured with a static IP
> this shouldn't present a risk.  If, however, both are dynamic, (say
> DHCP assigned) then this would qualify as a security hole, possibly a
> huge one.  To be fair, this is probably a very rare intersection of
> situations, but if eth0 is the untrusted network, then any failure
> would be an annoyance, not a risk.

..in a hobbyist environment, agreed.  In business, you want to minimize
the impact of such failures, the easiest way is to use the hardware
addresses to ID your nics, if one fails, only it fails, without leaving
the entire box open for outsiders on the "now trusted" nic.  ;-)


-- 
..med vennlig hilsen = with Kind Regards from Arnt... ;-)
...with a number of polar bear hunters in his ancestry...
  Scenarios always come in sets of three: 
  best case, worst case, and just in case.

Re: OT: curious about eth0/eth1

[Maciej Soltysiak]

> Again.. I am just curious as to why some do it one way.. and some the
> other... the above is only MY opinion, and could be dreadfully wrong :)
Well, i never care for which is internal or external, sometimes i set up
eth1 as external, sometimes it's eth0 or ppp0. What is funny,
on my experimentalbox i have the network with default route on eth1, and
eth0 is connected to a roaming port in a 3com corebuilder (== i get a copy
of the whole Internet<->LAN traffic), it's unusual, and i very often have
to reconfigure programs that make this assumption that eth0 is the
Internet interface.
I take it as totally free to choose, and propably random.

Anyway i alwyas refer to interfaces as EXT, INT, not their names.

Regards,
Maciej Soltysiak

Re: OT: curious about eth0/eth1

[Tommy McNeely]

Joel,

You pose an interesting case, one to which I had certainly not thought of, 
but as my "firewall" is generally the DHCP server for the internal network 
(among other things) it pretty much has to have a static IP configured for 
eth0.

On a side note... the case you speak of is easily averted by using 
different cards :)

[root@pickles root]# cat /etc/modules.conf
alias parport_lowlevel parport_pc
alias eth0 3c59x
alias eth1 eepro100
alias eth2 tulip


anyhow.. I am glad folks are responding.. I think its an interesting topic 
:)

Tommy



--On Tuesday, January 07, 2003 10:47:24 PM -0500 Joel Newkirk 
<netfilter@newkirk.us> wrote:

> On Tuesday 07 January 2003 06:59 pm, Tommy McNeely wrote:
>> I am curious about why people choose to make a certain interface
>> internal or external...
>
>> I notice several people pick eth0 as their outside interface, and
>> sorta "oh yea" the rest of the inside network is on eth1.  I know the
>> linux kernel could really care less what they are called, its mostly a
>> "neatness" thing I guess... Also it seems like that leaves your box
>> open to attack from the time it installs (if you do a NET based
>> install) till the time you get around to actually putting a firewall
>> on it.
>
> Why would this in particular leave a box exposed?
>
> I think that the main reason for 'some one way, some the other' is random
> chance.  However, consider this scenario:
>
> You have two NICs, eth0 and eth1. The connections on one you trust (-i
> eth0 -j ACCEPT), the other you don't.  One of them fails, or the board
> works loose from it's socket, or something, so that upon booting the
> machine you only have one interface.  No matter which board fails, the
> remaining board would be eth0.  If eth0 is your 'trusted' internal
> network in normal conditions, and it fails, then suddenly the untrusted
> network is operating under the trusted network's rules.  However, the IP
> assignment (if static!) would remain that of the trusted network, so as
> long as eth0 is configured with a static IP this shouldn't present a
> risk.  If, however, both are dynamic, (say DHCP assigned) then this
> would qualify as a security hole, possibly a huge one.  To be fair, this
> is probably a very rare intersection of situations, but if eth0 is the
> untrusted network, then any failure would be an annoyance, not a risk.
>
> j
>
>
>



--
Tommy McNeely         --        Tommy.McNeely@Sun.COM
Sun Microsystems - IT Ops - Broomfield Campus Support
Phone:  x50888 / 303-464-4888  --  Fax:  720-566-3168