Looking for a place to test your hacker skills?

Then check out this capture-the-flag game I unveiled at Notacon-

https://pwn0.com

Cheers
Charlie

VRFs and VLANs offer equivalent security.  The most common security issue with either is misconfiguration.

The Visio looks good.  Since you have overlapping IP addresses, you'll need to do some NAT before you uplink to the VRFs to a common point.

In this case I'd create a VRF per customer, tie these to separate firewall contexts (virtual firewalls) where they're NAT'ed to unique addresses.

Charlie

VRF-lite isn't a protocol; just the name of the feature that allows for multiple routing tables.

Simple example- you have a router with a connection to your WAN and to the Internet.  You want to force traffic from the WAN to the Internet (and vice versa) to traverse an attached firewall.

With VRF-Lite this is easy...

1) assign the WAN link to a second routing table (VRF)
2) connect the firewall to both routing tables (either 2 physical links or a trunk carrying 2 VLANs)
3) add a route to the global routing table saying the WAN is reachable via firewall interface 1
4) add a route to the second (VRF) routing table saying the Internet is reachable via firewall interface 2

Hope this helps,
Charlie

Dynamic updates are available without AD integrated zones, as long as you don't need 'dynamic update security'-

http://technet.microsoft.com/en-us/library/cc784052.aspx


Hope this helps,
Charlie

If it's good enough for Matasano, it's good enough for me-

http://www.matasano.com/log/1342/my-pentest-secret-password-guessing/

Yo!  I'll be there presenting on Snort, ClamAV, and embedded Linux-

http://carolinacon.org/index.php/schedule/

Hope to see y'all in Chapel Hill!

Cheers 
Charlie

PacketProtector 3.0 has just been released-

http://packetprotector.org/

PacketProtector 3.0 is built on top of OpenWrt Kamikaze 8.09, and includes updates for Snort, DansGuardian, and ClamAV.

Cheers!
Charlie

From bossconference.com-


Bummer. 

PacketProtector Light 1.0 is finally out!

http://packetprotector.org/forum/viewtopic.php?id=3572

This provides IPS and remote access VPN for the WRT54G/GL.

Cheers,
Charlie

Not yet.    There will be a 'light' version coming in the next few weeks that'll support the WRT54G/GL (and other ASUS and Buffalo routers). 

It'll be the same code, minus the web AV and WPA Enterprise features (because of resource constraints).

Dudes,
Please check out our OpenWrt-based security distribution for wireless routers at http://packetprotector.org.

It provides IPS, web AV, VPN, and WPA Enterprise wireless on your Linksys WRTSL54GS or ASUS WL-500g (Deluxe|Premium).

Thanks!
Charlie