Networks

Ask something
Discussion Locked

Internet connection sharing

0 helpful
7 replies

by info-man-

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.
I want to allow employees to take their laptops home to connect to the office. I want them to be able to use their current high speed internet connection at home to connect to the office via VPN. I want to set up ICS on their home pc, with an address on that adapter of 192.168.0.1. Then the laptop will be 192.168.0.2. The outside adapter on the home pc will be whatever the ISP requires, mostly DHCP I suppose. So the question is, if I do not enable file and print sharing on the outside adapter of the home pc, and the laptop is connnected to the internal adapter, do I need a firewall on the home pc to protect the info that will reside on the laptop? I know that a firewall can't hurt any, but is it really necessary for the average user to have this? Most ISP's use DHCP anyway. If I did use a firewall, would I have to put in an acceptable IP range that the ISP would assign that adapter? With DHCP from the ISP, they are likely to receive a any IP address in a particular range thatthey assign. I guess the biggest question is do I need a firewall or not, and why?

7 replies

by benwagg

Yes, I would recommend a firewall on the home PC.

The ISP's DHCP is no guarantee that someone will not attack their particular range of IP addresses.

Suppose I am a bored hacker, and I choose to probe a range of 10,000 addresses just to see ifI can take advantage of any weaknesses. Your home-client's ISP may have purchased their 100 IP addresses somewhere within that range, and assigned one of those to his connection. My script or application will report back to me that I have found an always-on connection with no firewall. I don't care that it doesn't have a static IP. I may just want to capture any saved passwords from his registry (no firewall!) and learn what password he uses to connect to your server's static IP address. By theend of the weekend, I will own your network and no one will have a clue how I got in...

Not only that, but even with my high speed ISP using DHCP, he may be assigned the same address for weeks-months at a time. The DHCP client requests a new address when it has reached 50% of its current lease, so it is not unusual for an always-on cable modem to get the same address repeatedly/continually. I (hacker) probably wouldn't even have to install a hidden service to covertly notify me when his wide-open PC's IP address is changed by DHCP.

DHCP is like a mechanism to assign street addresses and publish them in a phone book. It does nothing to lock the deadbolt on your door.

by benwagg

IMO your entire network would be at risk, to whatever extent the home-user has access. If the home-user has network logon credentials saved on his hard drive, then those credentials are at risk as soon as an experienced hacker gains access to the home-user's hard drive.

With a laptop rather than a desktop system, I would think it is less likely that s/he would leave it on/connected/unattended for long periods. Reduce the time it is exposed to hackerdom, and you probably reduce the risk of intrusion. However, I prefer to err on the side of caution...

Door-locks are expensive and inconvenient. I have ~200 neighbors in my neighborhood. The odds of a burglar randomly picking my neighborhood and then also randomly picking my house are probably pretty good in my favor. I still lock my door.

by info-man-

I appreciate the answer. So is the laptop safe having the internal address, and only the home pc at risk, or are they both at risk?

by joseph moore

I agree with Answer1. ANY Internet connection needs a software firewall at LEAST (and a hardware firewall is best)!
Most ISPs will assign via DHCP public IP addresses that are LIVE on the Internet! They don't assign the private 10.x.x.x or 192.168.x.x range to their users. They buy a block of public IPs, and assign them with their DHCP servers. So yes, your users might get a DHCP-assigned address, but it is also a public, routable IP.
And it is not that difficult for a good hacker/cracker to connect to an unsecured system. That is just the reality of the Internet.
Now, the laptop is also vulnerable to the remote connection. You can go through one machine you have penetrated to see the internal network. If the user had a drive mapping ontheir home system that pointed to the laptop, the remote unauthorized user could piggy-back over that drive mapping!
So, go with software firewalls at least! I run ZoneAlarm on my laptop (that I only have dial-up access with! Yes, I am so paranoid I run a firewall on a dial-up machine!). The free version of ZA is good, actually! Or you could get the $30 ZA Pro version. You might be able to get some type of volume discount.
You will have to go to the homes of your users and configure ZA,though. Be ready for that!

hope this helps

This discussion is closed to new replies.