From owner-freebsd-security Wed Nov 28 22: 2:50 2001 Delivered-To: freebsd-security@freebsd.org Received: from pintail.mail.pas.earthlink.net (pintail.mail.pas.earthlink.net [207.217.120.122]) by hub.freebsd.org (Postfix) with ESMTP id 8088E37B417 for ; Wed, 28 Nov 2001 22:02:45 -0800 (PST) Received: from dialup-209.247.138.241.dial1.sanjose1.level3.net ([209.247.138.241] helo=blossom.cjclark.org) by pintail.mail.pas.earthlink.net with esmtp (Exim 3.33 #1) id 169KHU-0004kX-00; Wed, 28 Nov 2001 22:02:44 -0800 Received: (from cjc@localhost) by blossom.cjclark.org (8.11.6/8.11.3) id fAT5jfh06206; Wed, 28 Nov 2001 21:45:41 -0800 (PST) (envelope-from cjc) Date: Wed, 28 Nov 2001 21:45:41 -0800 From: "Crist J. Clark" To: klik Cc: Danny , freebsd-security@FreeBSD.ORG Subject: Re: Ipfw + bpf interaction Message-ID: <20011128214541.J3985@blossom.cjclark.org> Reply-To: cjclark@alum.mit.edu References: <000e01c17834$5cf1d670$020144c0@danny> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline User-Agent: Mutt/1.2.5i In-Reply-To: ; from klik@unstable.org on Wed, Nov 28, 2001 at 01:30:56PM -0500 X-URL: http://people.freebsd.org/~cjc/ Sender: owner-freebsd-security@FreeBSD.ORG Precedence: bulk List-ID: List-Archive: (Web Archive) List-Help: (List Instructions) List-Subscribe: List-Unsubscribe: X-Loop: FreeBSD.org On Wed, Nov 28, 2001 at 01:30:56PM -0500, klik wrote: > Put those deny statments before your divert rule It shouldn't make a difference unless the incoming HTTP connections are being redirected. > On Wed, 28 Nov 2001, Danny wrote: > > > Date: Wed, 28 Nov 2001 12:44:36 -0500 > > From: Danny > > To: freebsd-security@freebsd.org > > Subject: Ipfw + bpf interaction > > > > > > I've been experimenting with ipfw to horde off the hundreds of attempted > > http requests per day (primarily all from @home customers) which I > > suspect to be part of some lingering worm/ddos. My question is if a > > connection attempt will still be recorded by clog(8) if the source IP is > > blocked by ipfw? There is nothing wrong. The bpf(4) device sees packets before they are processed and blocked by ipfw(8). [snip] > > The rule seems to be added to ipfw's rule set, which for my box is as > > follows: > > > > 00050 1915738 1315695882 divert 8668 ip from any to any via ep1 > > 00100 3360 1384342 allow ip from any to any via lo0 > > 00200 0 0 deny ip from any to 127.0.0.0/8 > > 00300 0 0 deny ip from 127.0.0.0/8 to any > > 00400 1596 65772 deny log logamount 500 ip from > > another.bad.host to my.ip.address > > 00500 0 0 deny log logamount 500 ip from > > 67.161.0.0/16 to my.ip.address > > 65535 3795144 2623014796 allow ip from any to any However, if you are seeing these in the clog(8)s, you should also be seeing them later blocked. -- Crist J. Clark | cjclark@alum.mit.edu | cjclark@jhu.edu http://people.freebsd.org/~cjc/ | cjc@freebsd.org To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-security" in the body of the message