Whereas there is no substitute for secure and properly
configured hosts, there are times when it is desirable to get
additional protection by passing traffic to and from some hosts
through an additional protective filtering layer (usually called
a firewall). The traditional (and most secure) firewall is
physically inserted between the hosts to be protected and the
rest of the world, however this physical break in the network
may be impractical for various reasons. The logical firewall
(LFW) may be an attractive alternative because it can physically
exist anywhere on the subnet and protect hosts anywhere on the
subnet without rewiring. Protecting hosts with the logical
firewall involves giving them new and unroutable IP addresses
(by replacing the first octet of their public IP address with
10). The logical firewall box is configured (with a virtual
interface) to respond to the original/public address of the
protected host and to do routing and Network Address Translation
(NAT) to and from the protected host f