Date: Thu, 30 Nov 2000 19:47:35 +0200 From: Abraham vd Merwe <abz@frogfoot.net> To: FreeBSD ISP Related Questions <freebsd-isp@freebsd.org> Subject: Re: Danger Ports Message-ID: <20001130194735.A23238@oasis.fireblue.com> In-Reply-To: <200011301743.JAA44928@gndrsh.dnsmgr.net>; from freebsd@gndrsh.dnsmgr.net on Thu, Nov 30, 2000 at 09:43:57 -0800 References: <Pine.BSF.4.21.0011292044170.36849-100000@flux.c-zone.net> <200011301743.JAA44928@gndrsh.dnsmgr.net>
next in thread | previous in thread | raw e-mail | index | archive | help
--WIyZ46R2i8wDzkSu Content-Type: text/plain; charset=us-ascii Content-Disposition: inline Content-Transfer-Encoding: quoted-printable Hi Rodney! > Please do all the rest of us a favor and filter the > packets to reserved networks, not just from them. > =20 > > this is right out of the ACL for my core router.. > >=20 > > ! reserved networks =20 > > access-list 110 deny ip 127.0.0.0 0.0.0.255 any log > > access-list 110 deny ip 10.0.0.0 0.255.255.255 any log > > access-list 110 deny ip 172.16.0.0 0.15.255.255 any log > > access-list 110 deny ip 172.31.0.0 0.0.255.255 any log > > access-list 110 deny ip 192.168.0.0 0.0.255.255 any log >=20 > access-list 110 deny ip any 127.0.0.0 0.0.0.255 log > access-list 110 deny ip any 10.0.0.0 0.255.255.255 log > access-list 110 deny ip any 172.16.0.0 0.15.255.255 log > access-list 110 deny ip any 172.31.0.0 0.0.255.255 log > access-list 110 deny ip any 192.168.0.0 0.0.255.255 log Actually I have a more complete spoofing template for you: !! !! Spoofing ACL !! ! Deny any packets from the RFC 1918, IANA reserved, test, ! multicast as a source, and loopback netblocks to block ! attacks from commonly spoofed IP addresses. ! All zero, all one access-list 2000 deny ip 0.0.0.0 0.255.255.255 any access-list 2000 deny ip host 255.255.255.255 any ! Claims it came from the inside network, yet arrives on the ! outside (read: Internet) interface. Do not use this if CEF ! has been configured to take care of spoofing. access-list 2000 deny ip 216.4.163.0 0.0.0.63 any access-list 2000 deny ip 216.4.162.104 0.0.0.7 any access-list 2000 deny ip 216.5.193.128 0.0.0.7 any access-list 2000 deny ip 216.5.193.160 0.0.0.3 any ! IANA reserved access-list 2000 deny ip 1.0.0.0 0.255.255.255 any access-list 2000 deny ip 2.0.0.0 0.255.255.255 any ! Loopback access-list 2000 deny ip 127.0.0.0 0.255.255.255 any ! RFC 1918 access-list 2000 deny ip 10.0.0.0 0.255.255.255 any access-list 2000 deny ip 192.168.0.0 0.0.255.255 any access-list 2000 deny ip 172.16.0.0 0.15.255.255 any ! Link local reserved access-list 2000 deny ip 169.254.0.0 0.0.255.255 any ! IANA example network access-list 2000 deny ip 192.0.2.0 0.0.0.255 any ! Multicast access-list 2000 deny ip 224.0.0.0 15.255.255.255 any ! Experimental access-list 2000 deny ip 240.0.0.0 15.255.255.255 any ! Allow IP access to the intranet (firewall filters specific ports) access-list 2000 permit ip any 216.4.163.0 0.0.0.63 access-list 2000 permit ip any 216.4.162.104 0.0.0.7 access-list 2000 permit ip any 216.5.193.128 0.0.0.7 access-list 2000 permit ip any 216.5.193.160 0.0.0.3 ! Our explicit (read: logged) drop all rule access-list 2000 deny any any --=20 Regards Abraham Laws are like sausages. It's better not to see them being made. -- Otto von Bismarck ___________________________________________________ Abraham vd Merwe [ZR1BBQ] - Frogfoot Networks P.O. Box 3472, Matieland, Stellenbosch, 7602 Cell: +27 82 565 4451 - Tel: +27 21 887 8703 Http: http://www.frogfoot.net Email: abz@frogfoot.net --WIyZ46R2i8wDzkSu Content-Type: application/pgp-signature Content-Disposition: inline -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.0.1 (GNU/Linux) Comment: For info see http://www.gnupg.org iD8DBQE6JpK3V+L3lxo9wFURAmgfAJwIpASssV7L6dmzar/0HwQMfS1YpQCgklcL /NKc6qj+99t2UMpwsi9OcSs= =tAx9 -----END PGP SIGNATURE----- --WIyZ46R2i8wDzkSu-- To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-isp" in the body of the message
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20001130194735.A23238>