FreeTDS Development Group

[Steven Peterson <speterson AT listpilot.com>]

James,

Yours would be my solution if I controlled all of the computers in the
network.  But the fact is that the computers I am trying to connect to are
clients' computers for which I am reluctant to ask to change their
firewall.  (There are many clients and each has a different procedure for
requesting changes.)  The computers I am connecting from use virtual IPs so
that the computers are easy to move around and upgrade without changing the
source IP (theoretically).  Simply changing the bind address works in all
my other database connections except for FreeTDS.  It is by far easier for
me to use a portable virtual IP address and specify it in a bind address
than contacting each client and getting them to update their firewall rules
whenever I upgrade or change my server configuration.  Please consider this
a use case supporting a bind address parameter.

That being said, FreeTDS is an awesome package and I don't know what I
would do without it; thanks for all the work you do on it.

- Steve


On Mon, Oct 29, 2012 at 3:03 PM, James K. Lowden <jklowden AT freetds.org>wrote:

> On Mon, 29 Oct 2012 12:19:44 -0400
> Steven Peterson <speterson AT listpilot.com> wrote:
>
> > It is quite common to have a linux server with multiple IP addresses
> > and only one of the IPs whitelisted by an external database server.
>
> If you say so.
>
> Why not fix the network/whitelist/firewall?  A rational organization
> avoids work instead of creating it.
>
> I see no reason to have a firewall between a TDS server and client,
> even if that client is a webserver.  I see still less reason to block
> legitimate packets from known interfaces.  Not only is extra admin work
> created, but the efficiency of the network is reduced.
>
> If the reason is "security" then the answer should explain the specific
> threat, and why ordinary routing rules are insufficient.
>
> --jkl
> _______________________________________________
> FreeTDS mailing list
> FreeTDS AT lists.ibiblio.org
> http://lists.ibiblio.org/mailman/listinfo/freetds
>