Site Description

This information is obsolete as regards the current Somarsoft Internet site. However, some of the technical information regarding routing is still useful.

Current Site

The Somarsoft web pages you are viewing are hosted by PSI, which has a T1 or faster Internet connection. The Somarsoft LAN is connected to the Internet via a 28.8 Kbps modem connection. The main Somarsoft gateway machine provides the following services:

Previously, the web site was located on the gateway machine. But as traffic to the web site increased, this configuration proved to be unacceptably slow. Splitting services between a local gateway with a limited speed connection for mail and other low-bandwidth services and putting high traffic web servers on a remote host, currently provides the best price/performance/manageability trade-off for smaller sites.

The gateway machine also provides full internet access to users on an internal ethernet network, allowing them to use standard TCP/IP services such as:

The gateway machine also has a Kbps dial in modem, which allows users to dial in using RAS from home and access either the internal ethernet network or the Internet, just as if they were connected locally.

The ISP provides the following services, in addition to Web hosting and dial-up connectivity:

A configuration similar to this is suitable for providing a low-cost and easy-to-administer full-time Web server and internet connectivity for:

Maintaining the PPP connection

The full-time PPP connection is maintained by the Somarsoft ReDial service, available here. ReDial does the following:

TCP/IP client software

Security considerations

Using bindings to establish a pseudo-firewall

There are two types of networking services:

The goal was to prevent outside users on the Internet from using the SMB protocol services. By running these services only over the unroutable NetBeui transport, there is no possibility of outside Internet users accessing these services. This provides an effective firewall, without the cost of a dedicated firewall machine.

Eventually, this scheme will be augmented or replaced by using an application proxy firewall running on the gateway machine (such as Microsoft's planned Catapult firewall). There is still the issue of how to prevent SMB type access to that gateway, and the protocol unbinding scheme described here may still be useful for that purpose.

The TCP/IP protocol services, on the other hand, are only used to communicate with the Internet. The internal nodes run TCP/IP client software but not services. The gateway machine runs TCP/IP services, but these are specifically intended for consumption by the outside world.

Therefore, bindings were enabled/disabled on ALL machines on the network (the modem binding, of course, only applies to the gateway), as follows (using the Bindings dialog of the Network applet of Control Panel): 

   Enabled transport layer bindings
      NetBeui     -> Ethernet adapter (internal network)
      TCP/IP      -> Ethernet adapter (internal network)
      TCP/IP      -> Modem RAS connection (external Internet)

   Enabled session layer bindings
      NetBios     -> NetBeui
      Workstation -> NetBeui
      Server      -> NetBeui

   Disabled session bindings
      NetBios     -> TCP/IP
      Workstation -> TCP/IP
      Server      -> TCP/IP

There remains a risk due to trojan horses or backdoors in any program running on any machine on the network. Such a program might initiate a TCP/IP connection with a cooperating server somewhere on the Internet and give complete access to all local and network files available to the user running the program. Therefore, it is very important to verify that all programs running on the network are trustworthy, especially TCP/IP client software. (This is not a completely new issue - you should already be checking that all programs running on the network are virus-free.)

TCP/IP configuration of gateway

Return to Somarsoft home page.
Send comments and questions to info@somarsoft.com
All material Copyright © 1995-1996 by Somarsoft, Inc.