Erik Norgaard wrote:
Noah wrote:
the servers and clients are not on the same LAN segment. capturing
MAC has nothing to do with this scenario.
You haven't exactly told a lot about the network you want to setup.
The logic thing is to authenticate against the firewall connected to
the same subnet - and that will know the mac address. The same setup
is assumed in the scenario using pfauth (or is it authpf).
alot of assumptions that are incorrect. the fireware is running as part
of freeBSD there is no edge firewall device to the LAN segment. your
ideas will not work for my scenario.
Also, unless you are going to give a lot of instructions to people on
how to configure their network, you will have a dhcp server on the
same subnet - why not let that also do the web service for user
management?
You haven't told either, how people connect - is it wireless or wired?
Some access points supports that people authenticate WPA+something and
the access point will verify against a radius server. And there are
other possibilities depending on your setup.
But whichever way you setup your network, I think the best solution is
if people establish an IPSec tunnel to the firewall, such that all
traffic not destined for the local subnet must be tunneled through
that. This gives you maximum control - you can even setup your
firewall so that traffic coming in on a IPSec tunnel is also filtered.
Cheers, Erik
_______________________________________________
freebsd-questions@freebsd.org mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-questions
To unsubscribe, send any mail to "[EMAIL PROTECTED]"
