From owner-freebsd-security Tue Jul 25 15:12:43 2000 Delivered-To: freebsd-security@freebsd.org Received: from mail.rdc1.il.home.com (ha1.rdc1.il.home.com [24.2.1.66]) by hub.freebsd.org (Postfix) with ESMTP id DBA9E37BA0A for ; Tue, 25 Jul 2000 15:12:31 -0700 (PDT) (envelope-from stephen@math.missouri.edu) Received: from math.missouri.edu ([24.12.197.197]) by mail.rdc1.il.home.com (InterMail vM.4.01.03.00 201-229-121) with ESMTP id <20000725221229.BLYW23923.mail.rdc1.il.home.com@math.missouri.edu>; Tue, 25 Jul 2000 15:12:29 -0700 Message-ID: <397E10CC.BF84B0E7@math.missouri.edu> Date: Tue, 25 Jul 2000 17:12:28 -0500 From: Stephen Montgomery-Smith X-Mailer: Mozilla 4.72 [en] (X11; I; Linux 2.2.14 i686) X-Accept-Language: en MIME-Version: 1.0 To: "Rodney W. Grimes" Cc: Mike Hoskins , freebsd-security@FreeBSD.ORG Subject: Re: Problems with natd and simple firewall References: <200007252128.OAA52048@gndrsh.dnsmgr.net> Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: 7bit Sender: owner-freebsd-security@FreeBSD.ORG Precedence: bulk X-Loop: FreeBSD.org "Rodney W. Grimes" wrote: > > And I'll cast my vote against -antispoof for the following reasons. > > a) The non-problem it attempts to solve can be handled by a correct > ipfw rule set. Well, now that I understand a bit how dynamic rules work, I'm going to agree with this vote against my own idea. Those dynamic rules are really very very nice. But maybe a dynamic rule set should be put into the default rc.firewall - perhaps not replace simple, but an additional - maybe call it dynamic. Also, it would be good to add some comments to rc.firewall to explain this. > > b) These are RFC1918 addresses and have little to nothing to do with > spoofing. RFC1918 != spoof. Spoofing occurs when using ligitmate > globally routed IP addresses, usually the attack targets address as a > source address in a packet. The flag should be -antirfc1918. That is easily fixed. --- So my programming effort was perhaps a waste of time, except I got to see some of the inner workings of natd - truly beautiful. -- Stephen Montgomery-Smith Department of Mathematics, University of Missouri, Columbia, MO 65211 Phone 573-882-4540, fax 573-882-1869 http://www.math.missouri.edu/~stephen stephen@math.missouri.edu To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-security" in the body of the message