Re: Q on external router

[Vinci Chou <vkmchou () hk super net>]

Bennett Todd wrote: 

> by
> using one DMZ interface on the bastion, and a hub for the hosts in the
> DMZ, and a trick: assign each DMZ host an address on a separate net
> --- again perhaps using the RFC 1918 addresses and NAT in the bastion.
> Give the bastion's DMZ interface, connected to the hub, addresss on all
> the nets. Have the clients in the DMZ, each on their own separate net
> (travelling over the same ether) all use the bastion for their default
> router. Then let the bastion's ipfw or ipfilter or whatever provide
> access restrictions among the DMZ hosts.

However, because these DMZ hosts are on the same phsical segment, even
they have different net numbers, a compromised host is still able to sniff
the traffic, isn't it ?


Vinci