WAN security in bridge mode

Greetings!
I have an Airport Extreme 802.11n hooked up to a cable modem, and I am pondering switching the Airport from NAT mode to bridge mode. The purpose is to give each client on the network its own WAN IP. As I share an apartment with two friends, this has benefits in that it allows each of us to be as hidden or visible on the internet as we like, without disadvantage to the others.
I am looking for some input on the security implications of this besides the obvious fact that all clients are now solely dependent on their own firewalls.
Some questions:
- I have two hard drives shared with AirDisk. If I have deselected the option to make them available via WAN, is this enough to keep anyone from accessing them from the outside?
- I know there is a lot of "background noise" on the internet – random infested computers scanning random IPs. This will of course be stopped by the firewalls on the clients (of which two of three are Macs), but is this traffic of such a volume that wireless performance will be affected?
- Do you have any other thoughts on the implications of such a configuration?
Any input is greatly appreciated!

Your ISP is most likely only allowing you one IP number. While you might be able to call them up and have another number added to your connection, if this is available, it will cost you more money. NAT not only acts as a firewall but it splits the one IP number up between two computers so that you don't have to pay an ISP for every piece of hardware on your network.
Even if you have share over WAN disabled, when you turn on bridge mode, that setting will disappear is it no longer applies and it will be accessible over the network.
So what do we have now? Your computer will be requesting an IP number and your roommates computer will be requesting one too, but wait the AEBS also wants its own number, so that's three numbers, plus you will also not be able to block people from trying to change settings on your router.
If you or your roommate are running any software that requires it be recognized by incoming network traffic, then take a look into setting up port forwarding or turning on host computer for for whichever machine needs this.

Similar Messages

Security Cameras & Bridge Mode

Hello,
I am instaling wireless security cameras in my house and I want to be able to monitor things while I am out of town. Try as I might, I am unable to see the cameras outside of my network. When I try to see the port at my current IP, I will get messages similar to "Connection Timeout"
I have a G90-610015-20 DSL modem using PPP0E Protocol. Would switching the modem to bridge mode help?

Yes that would help, as long as: #1 You have a RJ-45 WAN port router. #2 The RJ-45 WAN port of it is connected to the modem combo. #3 And you know the PPPoE Log-in info (user name and password)
If you are the original poster (OP) and your issue is solved, please remember to click the "Solution?" button so that others can more easily find it. If anyone has been helpful to you, please show your appreciation by clicking the "Kudos" button.

How To Access Files Remotely In Bridge Mode?

Hey guys, so I've got a TC and my roomate has a TC the only way we can get them both to work is hooked up to our router and placing both TC's to Bridge Mode. The issue is in Bridge Mode we've lost a lot of remote functionality. The main thing we both want to do is access our files when we're on the go. Is there a way to remotely access our TCs in bridge mode? I'm pretty techy so I'm open to any creative solutions.

but how will this solve the problem where I don't see "Share disks over WAN" on my TC?
The TC does not need that option....since it is already in Bridge Mode.
If the TC were also your router.....then it would be providing DHCP and NAT service....and the option to "Share..." would be needed....so it would appear so you could allow or open the WAN port. The example that Tesserax provides assumes that the TC is also the router......providing DHCP and NAT service.
You have a different layout. Another device is providing the DHCP and NAT routing, and the TC is in Bridge Mode.
Are you saying that option will become available when my TC sees the approptiate port is open?
You don't need the "option" at all in Bridge Mode. All ports are already open when the TC is in Bridge Mode. There is no WAN port in Bridge Mode....it automatically becomes a LAN port, so no need to "open" a port if it is already "open".

Question about TC setup, bridge mode and security...

Hello All
I need some help...
Have bought a 1 Tb TC to use with my existing ethernet/wireless all-Mac home network but have some specific queries.
The system is set-up as follows:
Cable modem > connected by ethernet cable to > 8-way Ethernet switch
Connected via ethernet cable to the 8-way switch are: one MacBook (in another part of the house) and the TC (via its WAN socket).
Elsewhere in the house, and _all connected wirelessly_ are:
iMac G5
Powerbook G4
hi-fi (connected via an Airport Express)
Airport Extreme basestation to which a HP Laserjet is connected via ethernet.
Question:
Before buying the TC, I used a spare Airport Express basestation in its place to act as the 'main' basestation and the IP addresses of each device on the network were 10.0.0.1, 2, 3, etc. I had the impression that my home network was not "seen" by the outside world as a consequence of this.
Now, the TC seems only to work when in 'bridge' mode and it seems that the IP addresses are 196.xxx.x.100, 101, 102 etc. Does this mean that these devices are now visible to the outside world. Have I compromised my network security? I am worried that the outside world may have access to the contents of my TC, although my TC is password protected and the wireless network is 'closed'. What else should I be doing?
Finally, should I have set up the network so that the cable modem feeds to TC directly, with the 8-way ethernet switch coming off one of the ethernet sockets on the TC?
In all honestly, the instructions in the manual and the help guide are less than clear.
Can anyone help?
Thanks
Daniel

Section 4, here are my thoughts.
1. Since you are currently seeing individual IP addresses like 196.xxx.xxx.100, etc., it sounds like your modem is also acting as a router. This also seems to be the case since the Time Capsule is only working in bridged mode (it wouldn't work in Share a Public IP address if another device is assigning private DHCP addresses). Now, you could still allow the Time Capsule to act as a DHCP server on your private network by enabling Connection Sharing as Distribute a range of IP addresses. This will create a private network within your private network where all the devices that are connected to your Time Capsule can see each other. If you leave it in bridged mode then you allow your cable modem to assign DHCP addresses and all devices that are connected to the Time Capsule or to your ethernet switch are on the same network.
2. Assuming your cable modem is acting as a router you shouldn't have to worry about security, although you will have to access your modem's settings to make sure port forwarding isn't enabled and that the firewall is turned on (although I'm sure it is). I personally would plug the ethernet switch into the LAN port of the Time Capsule and allow the WAN port of the Time Capsule to be plugged into the cable modem. I also would just leave the Time Capsule in bridged mode as well, that's what I do for my own personal network.

How to use SNMP to access interface counters for WAN port when not in bridged mode

Hi All,
Can't fault my timecapsule, however just struggling to get one little bit of functionality working. I'm keen to get access to the WAN port interface counter information via SNMP, so I can track total bandwidth/throughput & also volume.
I have no issue getting SNMP to work & can see the 2.4 & 5.0GHz network counters, also total number of WIFI clients, wlan0, wlan1 and bridge0 interfaces. Trouble is none of these are the WAN/external ethernet port.
I see that it is likely that I'm trying to find the vlan1 port, however from what I'm reading this may only be available when the device is running in a routed mode (I'm running in bridge mode).
Anyone able to suggest anything?

Some cable modem you can turn off NAT.. and then use the TC in router mode.. or even use DMZ if the cable router allows that.
Have you ever looked at gargoyle router firmware and its ability to count and quota all clients connecting to internet service.. it is a simply fantastic firmware and can be loaded onto a router that costs $70-130 dollars.. it is 3rd party but very solid if you choose the right combo.
http://www.gargoyle-router.com/wiki/doku.php?id=screenshots

Http secure-server on 887VA in bridge mode

I'm setting up an 887VA to bridge between vlan1 and the atm0 interface. For remote management and to access the https for web management on this device, can I pop one of the 4 fe interfaces into a different vlan to assign it an IP address?
Not critical, but since you can't assign individual fe interfaces to the bridge group, it would be nice.
TIA
Jason

HI Gilles,
this is quite confusing as I learnt in a workshop with some Cisco SEs that the CSM is bridging all traffic which is not destined to a VIP if you do bridged mode. I agree with you that you realy need the predictor if you are running secure/routed mode.
However Chi Wang (I hope that's your forename):
In regards of your first question:
I think nothing has to be done to get the reals directly the only thing which has to be ensured it that they are plugged in the correct vlan and reside in that vlan.
In regards of your second question:
Have you checked if the routing from the servers to the GW is done correctly (towards a gateway in the Layer3 subnett?)
Btw are the servers connected in the server vlan?
Have you done a ping from the MSFC towards the servers?
have you done a traceroute from the servers to the destination you want to reach? Where does the traceroute stop?
Some additional questions from my side:
You set up the CSM in bridged-mode however the reals could be on a different LAyer3 hop? What's your topologiy maybe you can give us a hint of how you config looks like and what's the topology.
Kind Regards,
Joerg

Does putting the airport in bridge mode effect the security of the internal private network

If I put my Airport Extreme in bridge mode for running Echolink, will it effect the security of my internal private network?

Not at all.

Is bridge mode secure?

I am using a imac connected to Time Capsule, then to tmobile cell spot booster, then to comcast modem. Apparently each has a function. But the TC made me change its setting to Bridge Mode. I'd wondering if this is less secure. Does the security come through the sign in I have to do for the Comcast and TMobile routers?

The security is furnished by the main network router, so in your case bridge mode is secure since you are connecting to the main network router.

Is it possible for SA540 to work in transparent bridge mode?

Hi all,
I've been considering to use a Cisco SA540 in an industrial project; please consider Scenario 1 and 2 files attached (bear with me - I'm an engineer, not an artist).
All networks mentioned in both scenarios are regular and well known Ethernet TCP/IP networks. The Corporate Network and Automation Network (including the DMZ) are in different subnets. The Corporate Network is the biggest one, similar to any company's corporate network you all know. The Automation Network exists for the purpose of operating and maintaining the industry process; it's smaller but highly critical. Only specific staff (automation staff and dedicated operators) have access to it. Although many devices and networks in the Automation Network are industry specific - not so well known, a small segment of it is plain Ethernet TCP/IP, as I've already stated. The Automation Network has a DMZ, where we lay servers that provide industry process information for the Corporate Network.
Scenario 2 may look at a first glance the best option, since it's simpler, doesn't require another router and benefits from Cisco SA540 support for both a LAN and a DMZ. The problem with Scenario 2 is the following:
Since both networks are maintained by different teams under different management, TI staff would have absolute control over the Cisco SA540. This way automation staff could not grant that the Automation Network is really protected from the Corporate Network.
TI staff may even demand for another device to interface with the Automation Network - which is not Cisco SA540, since they rule everything that lives in the Corporate Network. In this case, I have my hands tied!
Scenario 1 solves the above problems. Since automation would have absolute control over the Cisco SA540, they could grant security for the Automation Network (except for DMZ, but that's the reason why it is called a DMZ!). TI staff could ask for any router they prefer to interface with the DMZ, I would never mind about it.
Considering the above, I will probably be forced to adopt Scenario 1 instead of Scenario 2. So here comes my question: is it possible for Cisco SA540 to work with the same subnet for both WAN and LAN interfaces (in Scenario 1, no DMZ interface is required)? In other words, is it possible for Cisco SA540 to work in transparent bridge mode? I've been through all of the Cisco SA540 Administration Manual and as far as I could understand, routing is not an option - it is demanding.
Although I understand I could adopt Scenario 1 and still have different subnets for DMZ and the rest of the Automation Network by connecting the DMZ to the WAN interface and the rest of the Automation Network to the LAN interface in the Cisco SA540, I believe it's not worth the effort. The Automation Network is so small and we do all we can to keep it as simple as possible.

Adriano, there is a RV042G, which supports the gig ports and a 800 mbps nat throughput. Here is the datasheet
http://www.cisco.com/en/US/prod/collateral/routers/ps10907/ps9923/ps12262/data_sheet_c78-706724.html
If you are using a DSL connection, the SRP527/547 models may be an alternative. These models support the RFC 1483 Bridges EOA Please note the SRP547 should be 10/100/1000. Also note the SRP521/541 are Fast Ethernet units and they do differ from the SRP527/547. The main selling point of these devices are the FXS/FXO ports. So this may also be a bit of an "unfocused" solution. But it's worth throwing the idea out there!
Here is the admin guide;
http://www.cisco.com/en/US/docs/voice_ip_comm/unified_communications/srp540_series/administration/srp500_AG_2567701.pdf
Here is the datasheet;
http://www.cisco.com/en/US/prod/collateral/voicesw/ps6790/gatecont/ps10500/data_sheet_c78-550705.pdf

Can you share an external hard drive over a network when your Apple Airport Extreme is in bridge mode?

Hello, is it possible to share an external hard drive over a network when I have my Airport Extreme in bridge mode? I can't use my AE as my main router at the moment but still want to be able to use the hard drive on the network, and the router I am using isn't capable of adding an external hard drive. I use Windows 7 and the other router is a Netgear. I have searched the communities and have not come across an answer to this question. I have tried several configurations within windows to try and see the hard drive but none have worked. I can see the hard drive when I run Airport utlities, but it cannot be seen on the network. Thanks to anyone who can help!

I think there is some confusion in this thread..
If you are sharing on a local LAN port forwarding is not required.
is it possible to share an external hard drive over a network when I have my Airport Extreme in bridge mode?
Answer is yes.. no port forwarding, mapping whatever term is used.. is needed. Port mapping is required when you cross over a NAT router.. as long as all the devices are inside a single LAN.. then no port mapping.
I assign to my Airport Extreme, do I do so with the settings of:
Service: SMB
Type: TCP
Server IP: xx.x.x.x
Port Start: 445
Port End: 445
This would not work even from WAN.. SMB is blocked by all responsible ISP.. there is simply too many unprotected windows machines out there. If they allowed SMB .. the world would be flooded with hijacked bots. And stolen data like bank accounts. SMB is not a secure protocol.
But this is not necessary on a LAN.
The problem can be Mavericks which does a terrible job presenting network drives.. The usual recommendations are to use AFP or force the connection to CIFS (ie SMB1 not 2).
If you use airport,, then use AFP.
In finder.. Go, Connect to server.
AFP://AEname or AEIPaddress. (replace with the network name of the AE or its actual IP address).
When asked for password.. type public if you did not change it or use whatever password you put.
Store the password in the keychain.

Guest access in bridge mode

I want to set up a secure wireless network in our small office that will also allow clients to access the internet while in our waiting area. I also want to maintain our current wired network, which is connected to the internet through a Nortel router, connected to a DSL modem. Where would the Airport extreme be installed? - i.e., upstream or downstream from the router? Also, looking over Apple's network documentation, it appears that the Airport Extreme would be in Bridge mode when configured on an existing ethernet network with router, but the documentation is clear on the issue of setting up guest access in this kind of configuration.
In case you have not guessed, I am not an IT guy, so will be grateful for any helpful suggestions

Blind Lemon wrote:
I want to set up a secure wireless network in our small office that will also allow clients to access the internet while in our waiting area. I also want to maintain our current wired network, which is connected to the internet through a Nortel router, connected to a DSL modem. Where would the Airport extreme be installed? - i.e., upstream or downstream from the router? Also, looking over Apple's network documentation, it appears that the Airport Extreme would be in Bridge mode when configured on an existing ethernet network with router, but the documentation is clear on the issue of setting up guest access in this kind of configuration.
Guest access and bridge mode are incompatible on AirPort base stations. I'd connect an AirPort Extreme to your DSL modem, connect your wired network connections to the Ethernet ports of the AirPort Extreme, and take the Nortel router out of service. Depending on how many wired connections you need, you may also need an Ethernet switch. Besides the WAN port, an AirPort Extreme only has three available Ethernet ports.

Using an Airport Express with an Airport Extreme in bridge mode

Im trying to use an Airport extreme and an Airport express to have good Wifi coverage in a house. The current Wifi is from a Verizon Westfall modem/router. I went into setup on the modem/router and disabled the wifi, then connected the Extreme to one of the 4 ports on the modem/router. I setup the Extreme in bridge mode ( because I believe I dont want 2 differnt routers handing out local IP's, right? . Anyway, it seems to work fine but I'm trying now to hook up an Express to widen my wifi area. I have cat5 ports all over the house that go back to the Exteme's location so its not a problem to connect the Extreme to the Express via ethernet cable. Im wondering if its possible to use the Express hardwired to the extreme while in Bridge mode because I cant seem to set it up properly. Can anyone out there answer that question and/or give me instructions on setting up this scenerio.
Thanks!

I will reset it like you said and then I should have the cable from the Extreme going to witch port on the express?
WAN "O" port
To set up the Express, open AirPort Utility, click on the Express and click Manual Setup
Click the Base Station tab just below the icons to assign a device name for the Express, device password, adjust Time Zone, etc. Should look like this, in general:
Click the Wireless tab next to Base Station. Adjust as follows:
Wireless Mode = Create a wireless network
Wireless Network Name = Exact same wireless network name as the AirPort Extreme
Enter check mark next to Allow to be extended
Radio Mode = Automatic or same setting as the AirPort Extreme
Channel = Automatic
Wireless Security = Exact same setting as the AirPort Extreme
Wireless Password = Same wireless password as the AirPort Extreme
Verify Password
Setting should look like this, in general:
Click the Internet icon, then click the Internet Connection tab.
Connect Using = Ethernet.
Connection Sharing = Off (Bridge Mode)
Click Update to save settings
Things will look like this:
You will see a green light in 25-30 seconds.
Be sure to restart the entire network.

Why do I lose internet connection when I put airport extreme into bridge mode to correct Double NAT issue

I reset my airport extreme router the other day because I was too lazy to reset the password on my private network.
I have been reading the advice found on apple support communities and wide web, but the solutions do not solve any problems and often create new ones.
I'm regretting because everything was working just fine.
But I remember having this double nat error when I first set it up a few months back, but now I cannot resolve it.
I would live with the yellow light, but it seems that this double nat error is preventing my playstation 3 from connecting to the airport extreme.
When I put the aiport extreme into bridge mode, I loose all my wireless networks, even when I reboot the airport extreme and the modem.
I try rebooting the modem, then the airport. and vice versa. No internet.
I switch back to NAT/DCHP and the internet works fine on apple devices, but not the playstation 3, and I have the 1 Double NAT error.
I have a plain stock Motorolla modem and I can dial in and see settings (although nothing about NAT). I didn't see where to see them.
I tried setting the DHCP only but it said it didn't like the settings. is there a stock range i could be using?

I have a plain stock Motorolla modem and I can dial in and see settings (although nothing about NAT). I didn't see where to see them.
Exact model .. motorola make adsl, cable and probably wireless modems.. with some modems and some modem router.. we need exact info. What kind of broadband do you have?
I would note.. some of the motorola cable modems seem to have issues with the apple routers. If you are about due to change modems.. now is a good time.. not another motorola.
If the modem is a straight cable modem, the AE must be in router mode.. but you need to power down the cable modem. maybe for 20min so the new router can pick up the IP address.
You cannot use DHCP alone.. the ISP do not give you a block of IP addresses.
You cannot use bridge with a pure modem.. you will find it works.. but only to one device.
The only reason you get double NAT is the failure to pick up the public IP.
Give the info required..
If you have trouble, I need the actual IP of the modem. the actual IP of the AE WAN port when plugged in. Screenshots are good.

Port forwarding but can only connect to wifi in Bridge Mode

Hi
Our ISP is TalkTalk and we use their Fibre service which connects through a BT Open Reach Modem. The TalkTalk router seemed to causing drop outs in wifi on my macbook pro so I bought an Airport Time Capsule for the wifi router and to back up my mac.
We aren't issued with PPPoE details and the advice from the TalkTalk community was to connect with the Router in Bridge Mode. This has worked a treat with the various Apple and non Apple items we have in out house except one.
We have security cameras which we control through a Windows laptop and can view one out phones. To make this happen we have to set up port forwarding. However, we can't do this as it's in Bridge Mode (as far as I understand).
I'm afraid my knowledge of these things is very basic so I'm hoping that someone will have an easy answer to this. Anyone got any advice on how I can make this pretty white box do its stuff please?
Thanks in advance!

No idea what a double NAT is but you clearly do so here goes...
traceroute 8.8.8.8 on the mac gives as follows:
traceroute to 8.8.8.8 (8.8.8.8), 64 hops max, 52 byte packets
1 192.168.1.1 (192.168.1.1) 6.246 ms 2.840 ms 2.875 ms
2 89-168-80-1.dynamic.dsl.as9105.com (89.168.80.1) 14.513 ms 14.967 ms 20.831 ms
3 host-78-151-225-23.static.as13285.net (78.151.225.23) 19.752 ms 20.399 ms 28.106 ms
4 host-78-151-229-12.as13285.net (78.151.229.12) 19.760 ms
    host-78-151-225-140.static.as13285.net (78.151.225.140) 18.391 ms
    host-78-151-225-136.static.as13285.net (78.151.225.136) 18.467 ms
5 host-78-144-8-11.as13285.net (78.144.8.11) 29.582 ms
    host-78-144-8-53.as13285.net (78.144.8.53) 31.276 ms
    host-78-144-8-5.as13285.net (78.144.8.5) 27.278 ms
6 72.14.214.222 (72.14.214.222) 37.593 ms 25.132 ms
    72.14.242.127 (72.14.242.127) 30.195 ms
7 209.85.252.188 (209.85.252.188) 27.070 ms
    209.85.252.186 (209.85.252.186) 77.680 ms
    209.85.252.188 (209.85.252.188) 24.477 ms
8 209.85.253.90 (209.85.253.90) 24.506 ms
    209.85.253.196 (209.85.253.196) 29.255 ms
    209.85.253.90 (209.85.253.90) 26.403 ms
9 66.249.95.173 (66.249.95.173) 41.521 ms
    72.14.232.134 (72.14.232.134) 35.473 ms 30.789 ms
10 209.85.251.231 (209.85.251.231) 30.069 ms
    216.239.49.45 (216.239.49.45) 31.578 ms
    209.85.252.83 (209.85.252.83) 31.383 ms
11 * * *
12 google-public-dns-a.google.com (8.8.8.8) 38.442 ms 30.063 ms 30.282 ms
traceroute 8.8.8.8 on the mac plugged into the HG533 gives as follows:
traceroute to 8.8.8.8 (8.8.8.8), 64 hops max, 52 byte packets
1 192.168.1.1 (192.168.1.1) 0.999 ms 0.679 ms 0.668 ms
2 89-168-80-1.dynamic.dsl.as9105.com (89.168.80.1) 13.577 ms 12.817 ms 13.668 ms
3 host-78-151-225-23.static.as13285.net (78.151.225.23) 16.828 ms 15.490 ms 24.315 ms
4 host-78-151-225-140.static.as13285.net (78.151.225.140) 18.755 ms
    host-78-151-225-30.static.as13285.net (78.151.225.30) 20.538 ms
    78.151.229.0 (78.151.229.0) 19.488 ms
5 host-78-144-8-29.as13285.net (78.144.8.29) 23.690 ms
    host-78-144-8-39.as13285.net (78.144.8.39) 26.756 ms
    host-78-144-8-59.as13285.net (78.144.8.59) 23.145 ms
6 72.14.242.127 (72.14.242.127) 24.608 ms 26.403 ms
    72.14.214.222 (72.14.214.222) 22.601 ms
7 209.85.255.78 (209.85.255.78) 26.205 ms 23.783 ms
    209.85.252.186 (209.85.252.186) 25.291 ms
8 209.85.253.94 (209.85.253.94) 25.553 ms
    209.85.253.196 (209.85.253.196) 58.607 ms 31.902 ms
9 66.249.95.173 (66.249.95.173) 49.369 ms
    72.14.232.134 (72.14.232.134) 32.418 ms 32.654 ms
10 72.14.238.43 (72.14.238.43) 34.146 ms
    209.85.252.83 (209.85.252.83) 34.292 ms
    216.239.49.45 (216.239.49.45) 29.860 ms
11 * * *
12 google-public-dns-a.google.com (8.8.8.8) 36.619 ms 36.902 ms 29.731 ms
Hope this gives the result we're after

Guest network in bridged mode (or other non-DHCP mode)

Hello,
I have the (Simultaneous Dual Band II) Airport extreme.
I wanted to use it at work but creating a secure network (my printer, computers, and drives) and a guest network (no password so people can access internet).
They already have a DHCP server (in the past I have a mistake by forgetting to turn off DHCP on a router which assigned other computers IP address (upstream) which conflicted with their DHCP server and all kinds of problems ensued).
So I know that in Bridge Mode, the guest network is turned off.
What are my options? I'm afraid to take if off bridge mode because of the DHCP issue. But I really want to use the dual network mode on the Airport Extreme.
So I don't want to bring down the whole network, can i safely use something other than bridge mode? other ideas?
Thanks in advance for any feedback
(yes I have searched a lot for the issue but I'm not sure what to do)

First, you question the policies about my work place (none of your business).
Sorry for suggesting that you check the policies before you violate something that could get you fired.
But then, you "would bet" that I hooked something wrong (could have asked).
Sorry but that is certainly a higher probability than a router malfunctioning in that manner.
It may not be your intention (just as it is not mine to be ungrateful).
Not sure if you are showing that with your last post.

WAN security in bridge mode

Similar Messages

Maybe you are looking for