Unoffical empeg BBS

Quick Links: Empeg FAQ | Software | RioCar.Org | Hijack | jEmplode | emphatic
Repairs: Repairs | Addons: Eutronix | Cases

Topic Options
#343678 - 23/03/2011 00:24 Network question: use DSL modem's 4-port in bridge mode?
mlord
carpal tunnel

Registered: 29/08/2000
Posts: 13884
Loc: Canada
I have a DSL modem/router with a built-in 4-port LAN switch. The modem/router is used only in bridge mode, so it acts only as a modem not as a router. I have a separate router that connects to it via one of the LAN switch ports. The separate router runs PPPoE to establish internet connectivity through the bridged modem.

Can I safely use the other three ports on the modem as ordinary LAN ports? I know I can use them, because I do, and it all works nicely.

But I don't know if any LAN traffic leaks out through the modem when doing this. Is it even possible for that to happen, given that the modem is just a PPPoE bridge ?

Thanks

Top
#343681 - 23/03/2011 00:29 Re: Network question: use DSL modem's 4-port in bridge mode? [Re: mlord]
gbeer
carpal tunnel

Registered: 17/12/2000
Posts: 2661
Loc: Manteca, California
So what is your definition of "safely"?
_________________________
Glenn

Top
#343682 - 23/03/2011 00:35 Re: Network question: use DSL modem's 4-port in bridge mode? [Re: gbeer]
mlord
carpal tunnel

Registered: 29/08/2000
Posts: 13884
Loc: Canada
Originally Posted By: gbeer
So what is your definition of "safely"?

Originally Posted By: mlord
But I don't know if any LAN traffic leaks out through the modem when doing this.

Not leaking LAN traffic would be the definition.

Top
#343686 - 23/03/2011 00:55 Re: Network question: use DSL modem's 4-port in bridge mode? [Re: mlord]
wfaulk
carpal tunnel

Registered: 25/12/2000
Posts: 16706
Loc: Raleigh, NC US
Without knowing a lot more about how the modem deals with its traffic there's no way to know for sure. However, given that you have a computer of some nature behind the modem and still communicating with something on the other side of the modem via Ethernet, it seems to me that it is possible for such data to leak out under the right circumstances. Effectively, anything plugged into that switch, even on the other side of your broadband link, is going to be on the same physical Ethernet (layer 2) network, and anything that can gain access to that network has an avenue of attack. If you could segregate those extra ports into a separate VLAN then you should be okay, but even if the switch supports VLANs, which it probably doesn't, you probably don't have enough access to configure it.

My guess is that if you're paranoid enough to ask, then it's probably not safe enough for you.
_________________________
Bitt Faulk

Top
#343688 - 23/03/2011 01:10 Re: Network question: use DSL modem's 4-port in bridge mode? [Re: wfaulk]
mlord
carpal tunnel

Registered: 29/08/2000
Posts: 13884
Loc: Canada
I figure it is safe. But I also know there are enough bright people here to think of any loopholes. smile

The only connection from the modem to the outside world is via ethernet packets being transported over ATM. Ethernet packets are strictly routed point-to-point by MAC address. It is not possible for an ethernet packet to be sent over the phone line (ATM) unless the source knows the MAC address of something on the other side.

In the modem, the only way this happens is within the envelope of the PPPoE session. Packets arriving at the modem without a PPPoE wrapper simply cannot be routed.

That's my understanding. smile

Cheers

Top
#343691 - 23/03/2011 01:28 Re: Network question: use DSL modem's 4-port in bridge mode? [Re: mlord]
wfaulk
carpal tunnel

Registered: 25/12/2000
Posts: 16706
Loc: Raleigh, NC US
Right. They can't be routed (that is, cross IP network boundaries), but the packets could conceivably be seen on the other side of the modem itself connection. This could be at the phone company, the ISP (if it's different from the phone company), or someone that has tapped your phone line.

Effectively, the phone company is using ATM as a bridge between two segments of an Ethernet network. Part of the PPPoE protocol is discovery of the MAC address of the PPPoE "server", and it accomplishes this via a broadcast Ethernet packet. I don't see what would prevent other broadcast Ethernet packets. And that sort of a bridge is not really any different from the way Ethernet switches (as opposed to hubs) work nowadays anyway.

So the question is: are you okay with one of the ports on your LAN Ethernet switch being connected to your ISP, through the phone company through a largely physically insecure series of copper and fiberoptic cables?
_________________________
Bitt Faulk

Top
#343692 - 23/03/2011 01:49 Re: Network question: use DSL modem's 4-port in bridge mode? [Re: mlord]
K447
addict

Registered: 29/05/2002
Posts: 676
Loc: Toronto, Ontario, Canada
This is just to employ the 3 'unused' ports as a simple hub, rather than having a separate small hub? confused

Small hubs are not expensive. Why bother with the risk of re-using those ports on the modem?

Top
#343694 - 23/03/2011 02:11 Re: Network question: use DSL modem's 4-port in bridge mode? [Re: mlord]
drakino
carpal tunnel

Registered: 08/06/1999
Posts: 7868
Loc: Seattle, WA
Who makes the DSL modem out of curiosity?
_________________________
Tom

Top
#343699 - 23/03/2011 03:10 Re: Network question: use DSL modem's 4-port in bridge mode? [Re: drakino]
Shonky
pooh-bah

Registered: 12/01/2002
Posts: 1956
Loc: Brisbane, Australia
I do exactly that with a Billion modem. It also allows direct access to the modems internal webserver too which can be handy. I just give it a LAN IP address.

Not actively looked for any dodginess but given the PPPoE stuff is all happening on the separate firewall box, I can't see how anything can get anywhere on the ADSL itself.
_________________________
Christian
#40104192 120Gb (no longer in my E36 M3, won't fit the E46 M3)

Top
#343700 - 23/03/2011 06:53 Re: Network question: use DSL modem's 4-port in bridge mode? [Re: mlord]
frog51
pooh-bah

Registered: 09/08/2000
Posts: 2089
Loc: Edinburgh, Scotland
What configuration options does your modem/router give you? By default many are set up that the default route for all traffic on the LAN ports is outbound.

Which means they do get encapsulated up and spat over ATM to the ISP for onward forwrding.

Easy to turn off though - just change the default route for those other ports.
_________________________
Rory
MkIIa, blue lit buttons, memory upgrade, 1Tb in Subaru Forester STi
MkII, 240Gb in Mark Lord dock
MkII, 80Gb SSD in dock

Top
#343704 - 23/03/2011 10:45 Re: Network question: use DSL modem's 4-port in bridge mode? [Re: frog51]
mlord
carpal tunnel

Registered: 29/08/2000
Posts: 13884
Loc: Canada
But this is just a modem, in bridge mode. Not a router. So it doesn't have "routes" to manage. Any thoughts of routing IP/TCP don't come into the discussion at all.

The only thing the modem knows about are ethernet packets, which are strictly routed by MAC. So unless something on my LAN feeds it a packet with the MAC of the DSLAM at the far end, then no ethernet packets will travel across the phone wires. EDIT: or perhaps they may pass that far, then get dropped at the far end due to MAC mismatch?

Bitt brought up the one point I'm only 99% certain about: what happens with ethernet broadcasts, that are not MAC address specific?

The regular PPPoE negotiation from the router, through the modem, to the DSLAM, and back.. uses PADI/PADO MAC discovery broadcasts, which are specific to the PPPoE protocol.

I suppose the Great Unknown here is whether or not the modem ever passes any other broadcast packets through the phone wires, or if it identifies and passes on only the PADI/PADO ?

For the curious, the "modems" in this case are by TP-Link. One is a TD-8841, the other is a TD-8901G at a buddy's house. Each has a built-in 4-port LAN switch, built-in router (disabled), and ADSL2+ modem.

We're each using them with multi-line MLPPP, managed by a WRT54GS/L router with Tomato/MLPPP on it. Since I have two modems here, one connects to the router over the (totally secure) WAN port, the other uses a LAN port. Since the latter is already on the LAN, its three extra ports become available for LAN use too.

In my buddy's case, his modem is in the basement, but the router is in his second floor office, with a single ethernet link between them. He needs more ethernet ports in the basement, so we just use the spare ports on his modem. This avoids the need to open up walls for running additional ethernet cables.

(yes I know/use the trick of two ethernets per cat-5 cable, too).

Cheers



Edited by mlord (23/03/2011 10:54)

Top
#343711 - 23/03/2011 19:22 Re: Network question: use DSL modem's 4-port in bridge mode? [Re: mlord]
mlord
carpal tunnel

Registered: 29/08/2000
Posts: 13884
Loc: Canada
Mmm.. having thought and read about all of this much more now, I believe Bitt's assessment to be pretty accurate. Ethernet broadcasts are probably leaking out, and the ISP and/or carrier could perform ARP attacks back in if they felt like it.

I'll fix that in my setup with a VLAN sometime Real Soon Now.

Cheers

Top