Date: Wed, 28 Jan 1998 08:16:35 +0200 (SAT) From: Reinier Bezuidenhout <rbezuide@oskar.nanoteq.co.za> To: jdp@polstra.com (John Polstra) Cc: archie@whistle.com, hackers@FreeBSD.ORG Subject: Re: ipfw patch Message-ID: <199801280617.IAA23275@oskar.nanoteq.co.za> In-Reply-To: <199801280535.VAA29425@austin.polstra.com> from John Polstra at "Jan 27, 98 09:35:40 pm"
next in thread | previous in thread | raw e-mail | index | archive | help
> In article <199801280028.QAA18434@bubba.whistle.com>, > Archie Cobbs <archie@whistle.com> wrote: > > > > A good idea.. more traditional though would just be to add a flag > > to ipfw itself, like "-n" or something. > > > > -Archie > > > > alexlh@xs4all.nl writes: > > > I use ipfw a lot. It's really nice. > > > > > > One thing bothered me though; sometimes there would be a typo in the rules > > > file, causing ipfw not to finish adding all the rules. This has been a > > > problem, as most of our servers are located behind a large, locked door > > > and I usually do things to them over the network. > > > > > > I've patched ipfw so that it's now possible to let it process a ruleset > > > without actually adding the rules to the kernel. It now checks to see if > > > the executable is actually named 'ipfw' before the setsockopt() call. > > > Create a symlink named (for example) testipw pointing to the ipfw > > > executable, and all will be fine. > > I agree with Archie. It's best to avoid adding programs that change > their behavior based on the name used to invoke them. > True ... it should be a flag so that it is optional. The the case of the machine being a firewall, you would rather it didn't process any rules after the incorrect one (the behaviour like it is now) because you might be skipping a very important deny rule and add other rules that would make the system less secure. In such a specific case you would rather that it skipped all the other rules and just have the default deny at the end than a false sense of security. Even though it means that you must have a console or screen and keyboard connected :) Reinier ################################################################### # # # R.N. Bezuidenhout NetSeq Firewall # # rbezuide@oskar.nanoteq.co.za http://www.nanoteq.com # # # ###################################################################
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?199801280617.IAA23275>