• 2 Posts
  • 376 Comments
Joined 2 years ago
cake
Cake day: June 30th, 2023

help-circle



  • None of those speak to the reliability of iptables. They all sound like skill issues.

    In 15 years of network engineering iptables has been the simplest part.

    A layered approach with hardware firewalls is valid but when those firewalls get popped, looking at you Cisco, Fortinet, and PA you still want host level restrictions.
    Your firewall or switch should never be used as a jump host to servers














  • IP is the internet layer which is layer 2 and TCP is the transport layer which is layer 3.

    Why split physical and data link when they are so closely related? You can’t use vpi/vci on an ethernet port, you can’t use MAC addresses on a frame relay port. Bundle that shit together.

    Presentation, application, and session are all dealt with by the application anyway so why bother splitting them out from a network point of view?