3 ms·
It's also a lot easier to segregate traffic this way. Once you're coming in via openvpn, the traffic is on a completely different interface and IP range, makin
by thwarted 18y ago
It's also a lot easier to segregate traffic this way. Once you're coming in via openvpn, the traffic is on a completely different interface and IP range, making automatic/transparent proxying a breeze and firewall/iptables setup really straight forward.
- pmjordan 18y agoAbsolutely. It definitely beats going with your average access point's default of bridging wifi to your LAN, though it does make your wiring slightly more complicated. I use two separate VLANs actually, one for the unprotected wifi access points and one for the actual LAN traffic. You have to watch out that you use high-quality VLAN-capable switches, however, as some of the cheaper ones fall over and supply the world with your protected packets if you fill up their MAC address table with spoofed packets... which is of course easy to do via an unprotected access point. That kind of thing might stil DoS you with a good switch, but it shouldn't open up your network.
- thwarted 18y agoThe other good thing about doing it this way is that you can get device _and_ user level authentication (by using client certificates and password authentication). No more lame MAC filtering on your wireless firewall to limit access. The access point becomes just a dumb ethernet <-> wireless bridge.