<html><head></head><body><div>On Fri, 2018-08-31 at 18:30 -0500, r hayman wrote:</div><blockquote type="cite"><div>On Fri, 2018-08-31 at 17:13 -0500, o1bigtenor wrote:</div><blockquote type="cite"><pre>On Fri, Aug 31, 2018 at 4:49 PM, r hayman <<a href="mailto:rhayman@pureice.com">rhayman@pureice.com</a>> wrote:
<blockquote type="cite">
On Thu, 2018-08-30 at 21:17 -0500, o1bigtenor wrote:
On Thu, Aug 30, 2018 at 5:16 PM, r hayman <<a href="mailto:rhayman@pureice.com">rhayman@pureice.com</a>> wrote:
Like Ioannis, I control my own LAN and isolate it from the "LAN" of the
ISP-provided device.
I currently have an Ubiquity EdgeRouter and its WAN port is the only thing
connected to the ISP-provided device.
I set the ISP-provided device into bridge mode (if I can't I have my ISP do
it).
When this is complete, my EdgeRouter WAN directly faces the Internet (gets
an Internet routable address).
I have the EdgeRouter set up as a DHCP server on the LAN side and have all
incoming and outgoing routes denied by default.
I add rules to allow only what I want in and out of my network.
I also have the ability to support VLANs for IoT devices that I don't want
on my LAN - they get a separate VLAN
Set up like this, my entire LAN operates within the LAN even when the ISP or
the WAN goes dark.
</blockquote>
Thank you.
I have some reading and then some thinking to do.
Have already been looking for 2 routers (I like to carry a spare so
that when one
dies that I have a replacement to hand).
When thinking is completed if I have questions I will be back at you.
Thanking you for your assistance.
Dee
_______________________________________________
TCLUG Mailing List - Minneapolis/St. Paul, Minnesota
<a href="mailto:tclug-list@mn-linux.org">tclug-list@mn-linux.org</a>
<a href="http://mailman.mn-linux.org/mailman/listinfo/tclug-list
">http://mailman.mn-linux.org/mailman/listinfo/tclug-list
</a></pre></blockquote><div><br></div><div>This picture should help you digest the concepts of firewall in, firewall out, and firewall local and how rules can be configured</div><div><a href="https://community.ubnt.com/t5/EdgeRouter/Layman-s-firewall-explanation/td-p/1436103">https://community.ubnt.com/t5/EdgeRouter/Layman-s-firewall-explanation/td-p/1436103</a></div><div><br></div><pre>_______________________________________________
TCLUG Mailing List - Minneapolis/St. Paul, Minnesota
<a href="mailto:tclug-list@mn-linux.org">tclug-list@mn-linux.org</a>
<a href="http://mailman.mn-linux.org/mailman/listinfo/tclug-list
">http://mailman.mn-linux.org/mailman/listinfo/tclug-list
</a></pre></blockquote><div><br></div><div>With my setup, the GRC Shields Up scan tells me this:</div><div>"<span style="color: rgb(0, 0, 96); font-family: Verdana, Arial, Helvetica, sans-serif, 'MS Sans Serif'; font-size: small;">Your system has achieved a </span><b style="color: rgb(0, 0, 96); font-family: Verdana, Arial, Helvetica, sans-serif, 'MS Sans Serif'; font-size: small;">perfect</b><span style="color: rgb(0, 0, 96); font-family: Verdana, Arial, Helvetica, sans-serif, 'MS Sans Serif'; font-size: small;"> "TruStealth" rating. </span><b style="color: rgb(0, 0, 96); font-family: Verdana, Arial, Helvetica, sans-serif, 'MS Sans Serif'; font-size: small;">Not a single packet</b><span style="color: rgb(0, 0, 96); font-family: Verdana, Arial, Helvetica, sans-serif, 'MS Sans Serif'; font-size: small;">
— solicited or otherwise — was received from your system as a result of
our security probing tests. Your system ignored and refused to reply to
repeated Pings (ICMP Echo Requests). From the standpoint of the passing
probes of any hacker, this machine does not exist on the Internet. Some
questionable personal security systems expose their users by attempting
to "counter-probe the prober", thus revealing themselves. But your
system wisely remained silent in every way. Very nice."</span></div></body></html>