Date: Wed, 28 Nov 2001 13:30:56 -0500 (EST) From: klik <klik@unstable.org> To: Danny <eyezonme@gmx.net> Cc: <freebsd-security@freebsd.org> Subject: Re: Ipfw + bpf interaction Message-ID: <Pine.LNX.4.33.0111281329250.23570-100000@ezri.unstable.org> In-Reply-To: <000e01c17834$5cf1d670$020144c0@danny>
next in thread | previous in thread | raw e-mail | index | archive | help
Put those deny statments before your divert rule On Wed, 28 Nov 2001, Danny wrote: > Date: Wed, 28 Nov 2001 12:44:36 -0500 > From: Danny <eyezonme@gmx.net> > To: freebsd-security@freebsd.org > Subject: Ipfw + bpf interaction > > > I've been experimenting with ipfw to horde off the hundreds of attempted > http requests per day (primarily all from @home customers) which I > suspect to be part of some lingering worm/ddos. My question is if a > connection attempt will still be recorded by clog(8) if the source IP is > blocked by ipfw? The reason I ask is because I am still seeing > connection attempts in the network log from a specific IP belonging to a > class B network which I thought I had blocked. The syntax for the rule I > used was: > > ipfw add deny log logamount 500 ip from 67.161.0.0:255.255.0.0 > to my.ip.address > > The rule seems to be added to ipfw's rule set, which for my box is as > follows: > > 00050 1915738 1315695882 divert 8668 ip from any to any via ep1 > 00100 3360 1384342 allow ip from any to any via lo0 > 00200 0 0 deny ip from any to 127.0.0.0/8 > 00300 0 0 deny ip from 127.0.0.0/8 to any > 00400 1596 65772 deny log logamount 500 ip from > another.bad.host to my.ip.address > 00500 0 0 deny log logamount 500 ip from > 67.161.0.0/16 to my.ip.address > 65535 3795144 2623014796 allow ip from any to any > > The firewall blocks 'another.bad.host' without any problems, at least > according to the ipfw logs, but I am still seeing connections from the > 67.161.0.0 subnet (where all the connections are coming from) in the > clog logs (that's fun to say). Do there seem to be any flaws in this > particular rule set? This is not intended to be a integral firewall, > just simply one to block some of the nuisances that have recently been > afflicting a machine on my network. Thanks for any pointers. > > Danny McQuade > > > > To Unsubscribe: send mail to majordomo@FreeBSD.org > with "unsubscribe freebsd-security" in the body of the message > To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-security" in the body of the message
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?Pine.LNX.4.33.0111281329250.23570-100000>