4 ms·

I've seen a whole high performance shadow network running behind NAT before, in order to get around the issue you describe. It worked fairly well as the NAT ro

by g_p 6y ago

I've seen a whole high performance shadow network running behind NAT before, in order to get around the issue you describe. It worked fairly well as the NAT router was presenting a WAN MAC address from a device that had already been "approved". Main reason was to get local 10Gbe available when the official LAN was still 100 Mbit (!!), and to enable new devices to be connected to the network without going through whatever official process was in place. I'd never risk letting official IT people image a system - I've had to send people with laptops that were missing graphics drivers to "shadow IT support" to get their system properly installed by someone that knows how to clean install a system and install the necessary drivers.

ta988 6y ago
Yes I got the routers approved as firewalls nobody bothered to check them again. This allowed me to have VLANs, avoid my VMs users to attack other machines on the university network (from any plug on a wall you could talk to any machine from the building no filters so all machines were spitting tons of packets for windows and apple sharing and spotify and attacks and so on). This also yes allowed me to add new machines any time I wanted to. I had proxies and I had a couple of public facing IPs with fixed lease and opened ports. All of that while also having to do my research work... Just because I wouldnt be able to do that work if I needed to wait weeks just for getting an answer that would turn in meetings with 5 people and chains of dozens of emails going up and down the ranks...
- g_p 6y ago
  Yes, ironically the networks is more secure when people do what you did, as you reduce the number of devices exposed to the "broadcast/multicast storm babble", and avoid contributing to it further. There's an awful lot of Spotify and Dropbox mDNS and local device discovery traffic that people never see until they run a network! Our "shadow IT" ended up so significant that we ended up able to directly request firewall changes and just send in the rule lines (in the correct format for the edge firewalls used) and they would be applied for us within the hour...
  - ta988 6y ago
    Fun thats exactly what I did once. I gave them the info in the order of the fields I saw in one of the screenshots of the GUI they were using to configure their firewalls (no idea what brand it was never saw that before). It was indeed much faster.

by g_p 6y ago

ta988 6y ago

Yes I got the routers approved as firewalls nobody bothered to check them again. This allowed me to have VLANs, avoid my VMs users to attack other machines on the university network (from any plug on a wall you could talk to any machine from the building no filters so all machines were spitting tons of packets for windows and apple sharing and spotify and attacks and so on). This also yes allowed me to add new machines any time I wanted to. I had proxies and I had a couple of public facing IPs with fixed lease and opened ports. All of that while also having to do my research work... Just because I wouldnt be able to do that work if I needed to wait weeks just for getting an answer that would turn in meetings with 5 people and chains of dozens of emails going up and down the ranks...

g_p 6y ago
Yes, ironically the networks is more secure when people do what you did, as you reduce the number of devices exposed to the "broadcast/multicast storm babble", and avoid contributing to it further. There's an awful lot of Spotify and Dropbox mDNS and local device discovery traffic that people never see until they run a network! Our "shadow IT" ended up so significant that we ended up able to directly request firewall changes and just send in the rule lines (in the correct format for the edge firewalls used) and they would be applied for us within the hour...
- ta988 6y ago
  Fun thats exactly what I did once. I gave them the info in the order of the fields I saw in one of the screenshots of the GUI they were using to configure their firewalls (no idea what brand it was never saw that before). It was indeed much faster.