<html><head><meta http-equiv="Content-Type" content="text/html; charset=utf-8"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class=""><br class=""><div><br class=""><blockquote type="cite" class=""><div class="">On 1 Dec 2017, at 23:26, Timothe Litt <<a href="mailto:litt@ieee.org" class="">litt@ieee.org</a>> wrote:</div><br class="Apple-interchange-newline"><div class=""><div class="moz-cite-prefix" style="font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; background-color: rgb(255, 255, 255);"><br class="Apple-interchange-newline">On 01-Dec-17 17:07, Dan Gahlinger wrote:<br class=""></div><blockquote type="cite" cite="mid:BL2PR16MB100982B260CA143A9289399DC9390@BL2PR16MB1009.namprd16.prod.outlook.com" style="font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0px; background-color: rgb(255, 255, 255);" class=""><div class="">a pi would do it.</div><div class="">and it's not opening it up</div><div class="">you open to just one port to just that pi</div><div class="">for just the pps</div><div class=""><br class=""></div></blockquote><span style="font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; background-color: rgb(255, 255, 255); float: none; display: inline !important;" class="">Not quite that simple. To expand on what I wrote previously: Typically, machines inside your router trust each other. In that case, once on the Pi (or SimH guest), a user has access to anything else on your internal network, unless you setup the right firewalls on each of your other internal machines. With a little care, it's not hard to setup a subnet for the Pi & emulated machines that everyone else can distrust.</span><br style="font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; background-color: rgb(255, 255, 255);" class=""><br style="font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; background-color: rgb(255, 255, 255);" class=""><span style="font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; background-color: rgb(255, 255, 255); float: none; display: inline !important;" class="">E.g. You open an ssh port to your Pi. A user who ssh's to that Pi now has a local address, and can ssh to your desktop - or browse for Windoze/NFS shares - or whatever. So you need to adjust the firewall on your desktop to be very careful about what it permits from the Pi. (And guests on the Pi.)</span><br style="font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; background-color: rgb(255, 255, 255);" class=""></div></blockquote><div><br class=""></div><div><br class=""></div><div>If you want to effectively isolate your bunch-of-simh-stuff you can use VDE for the networking, and _NOT_ connect the virtual switch to your real network. Then you have an island of machines that can talk between them but not to the outside world (not even their host). You can plug in different vde switches running on different machines and still keep that network isolated.</div><div><br class=""></div><div>Of course, the only way to log onto the machines would be TELNETing to a simh “serial port” attached to a TCP port. But that’s all.</div><div><br class=""></div><div>In case you need to connect the vde network to your real net you could set up momentarily an vde_plug or an vde_cryptocab while the “outside” access is closed. </div><div><br class=""></div><div>VDE provides a lot of flexibility. </div><div><br class=""></div><div>Oh, did I say klh10 can attach itself to VDE now? ;)</div><div><br class=""></div><div><br class=""></div></div></body></html>