From owner-freebsd-questions  Thu Jun  7  9:15:28 2001
Delivered-To: freebsd-questions@freebsd.org
Received: from avocet.mail.pas.earthlink.net (avocet.mail.pas.earthlink.net [207.217.121.50])
	by hub.freebsd.org (Postfix) with ESMTP id EB88937B403
	for <freebsd-questions@freebsd.org>; Thu,  7 Jun 2001 09:15:23 -0700 (PDT)
	(envelope-from ipthomas_77@yahoo.com)
Received: from scarlet.my.domain (ip46.buffalo11.ny.pub-ip.psi.net [38.26.224.46])
	by avocet.mail.pas.earthlink.net (EL-8_9_3_3/8.9.3) with ESMTP id JAA28476;
	Thu, 7 Jun 2001 09:15:16 -0700 (PDT)
Received: (from ipt@localhost)
	by scarlet.my.domain (8.9.3/8.9.3) id MAA01227;
	Thu, 7 Jun 2001 12:14:05 -0400 (EDT)
	(envelope-from ipt)
From: "Ian P. Thomas" <ipthomas_77@yahoo.com>
Message-Id: <200106071614.MAA01227@scarlet.my.domain>
Subject: Re: using ipfw's ``pipe'' to limit icmp traffic
In-Reply-To: <200106070028.f570SPW07419@misha.privatelabs.com> from "mi@aldan.algebra.com" at "Jun 6, 2001 08:27:12 pm"
To: mi@aldan.algebra.com
Date: Thu, 7 Jun 2001 12:14:04 -0400 (EDT)
Cc: freebsd-questions@freebsd.org
X-Mailer: ELM [version 2.4ME+ PL54 (25)]
MIME-Version: 1.0
Content-Type: text/plain; charset=US-ASCII
Content-Transfer-Encoding: 7bit
Sender: owner-freebsd-questions@FreeBSD.ORG
Precedence: bulk
List-ID: <freebsd-questions.FreeBSD.ORG>
List-Archive: <http://docs.freebsd.org/mail/> (Web Archive)
List-Help: <mailto:majordomo?subject=help> (List Instructions)
List-Subscribe: <mailto:majordomo?subject=subscribe%20freebsd-questions>
List-Unsubscribe: <mailto:majordomo?subject=unsubscribe%20freebsd-questions>
X-Loop: FreeBSD.ORG

	I add ICMP_BANDLIM as an option in the kernel.  It is used to
prevent just the sort of attacks you are using your firewall for.  I have
seen no slow down on my ping times since implementing it.

Ian

In the last episode, mi@aldan.algebra.com stated...
> Trying  to protect  our network  from  ICMP-based attacks,  I added  the
> following rules to the firewall:
> 
> 	pipe 1  config bw 64Kbit/s
> 	add pipe 1  log icmp from any to any in via OIF
> 	add allow icmp from any to any
> 
> 	(OIF is the Outside InterFace)
> 
> The assumption is, there  is not going to be _much_  of ICMP traffic, so
> if it ever needs more than 64Kbit/s, it is an attack...
> 
> This  seems to  work,  but when  I  try to  ping  something outised  the
> network, the ping  time is around 10 msec. Without  the above piping, it
> is around 0.5 msec.  It is the bandwidth, that I'm  trying to limit, not
> the minimum latency!
> 
> Even  more bizarre  is  that  the ping  times  are  _higher_ when  pings
> originate from  the firewall itself,  compared to those,  that originate
> from inside the firewalled network...
> 
> What am I doing wrong? Thanks!
> 
> 	-mi
> 
> 
> 
> 
> 
> 
> To Unsubscribe: send mail to majordomo@FreeBSD.org
> with "unsubscribe freebsd-questions" in the body of the message
> 


To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-questions" in the body of the message