Date: Sat, 12 Sep 2009 17:53:39 -0400 From: Maxim Khitrov <mkhitrov@gmail.com> To: Matthew Seaman <m.seaman@infracaninophile.co.uk> Cc: Free BSD Questions list <freebsd-questions@freebsd.org> Subject: Re: Rule equivalence of pf uRPF check Message-ID: <26ddd1750909121453t390f1ca0lb030fdd1cc6a4feb@mail.gmail.com> In-Reply-To: <4AAB9DBC.50007@infracaninophile.co.uk> References: <26ddd1750909120549ve82a843k464c1233c3a6f603@mail.gmail.com> <4AAB9DBC.50007@infracaninophile.co.uk>
next in thread | previous in thread | raw e-mail | index | archive | help
On Sat, Sep 12, 2009 at 9:10 AM, Matthew Seaman<m.seaman@infracaninophile.co.uk> wrote: > Maxim Khitrov wrote: > >> block in quick on $int_if from !$int_if:network >> block in quick on !$int_if from $int_if:network >> block in quick from $int_if >> >> The OpenBSD pf faq states that urpf-check is equivalent to the >> antispoof rules, but the antispoof section lists only the last two >> rules in my example as being equivalent. So the question is does urpf >> imply the first rule as well? > > Not if uRPF is intended as a general mechanism. =C2=A0What would happen i= f > you applied that on $ext_if (the external interface you connect to the re= st > of > the internet with)? =C2=A0It's perfectly valid for packets from other tha= n > directly > attached networks to be passed by your firewall -- not doing that would, = in > fact, > completely negate your web browsing experience... > > =C2=A0 =C2=A0 =C2=A0 =C2=A0Cheers, > > =C2=A0 =C2=A0 =C2=A0 =C2=A0Matthew Right, I should have mentioned that I'm only talking about internal interfaces that serve separate 10.x/16 networks. My $int_if network is 10.0/16 and it is not the default route. Under those conditions, would the urpf check block any traffic coming in on $int_if that doesn't come from 10.0/16 network? If not, can you give me an example of what would be allowed? One other related question. Would urpf block a packet arriving on any physical interface that has a source IP of 127.0.0.1 or any other IP assigned to the firewall itself? - Max
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?26ddd1750909121453t390f1ca0lb030fdd1cc6a4feb>