From owner-freebsd-net Fri Mar 31 6:39:34 2000 Delivered-To: freebsd-net@freebsd.org Received: from storm.FreeBSD.org.uk (storm.freebsd.org.uk [194.242.139.170]) by hub.freebsd.org (Postfix) with ESMTP id 5B29737B652 for ; Fri, 31 Mar 2000 06:39:25 -0800 (PST) (envelope-from brian@Awfulhak.org) Received: from hak.lan.Awfulhak.org (hak.nat.Awfulhak.org [172.31.0.12]) by storm.FreeBSD.org.uk (8.9.3/8.9.3) with ESMTP id PAA13815; Fri, 31 Mar 2000 15:39:14 +0100 (BST) (envelope-from brian@Awfulhak.org) Received: from hak.lan.Awfulhak.org (localhost [127.0.0.1]) by hak.lan.Awfulhak.org (8.9.3/8.9.3) with ESMTP id PAA03288; Fri, 31 Mar 2000 15:39:10 +0100 (BST) (envelope-from brian@hak.lan.Awfulhak.org) Message-Id: <200003311439.PAA03288@hak.lan.Awfulhak.org> X-Mailer: exmh version 2.1.1 10/15/1999 To: mm@i.cz Cc: freebsd-net@FreeBSD.ORG, brian@hak.lan.Awfulhak.org Subject: Re: Security of NAT "firewall" vs. packet filtering firewall. In-Reply-To: Message from Martin Machacek of "Fri, 31 Mar 2000 16:20:38 +0200." Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Date: Fri, 31 Mar 2000 15:39:08 +0100 From: Brian Somers Sender: owner-freebsd-net@FreeBSD.ORG Precedence: bulk X-Loop: FreeBSD.org > > On 31-Mar-00 Brian Somers wrote: > > In fact, there's a bug in libalias. Packets destined to anything > > that's not redirected (with PacketAliasRedirectAddr() or implicitly) > > should be redirected to the alias address according to the > > documentation. > > > > This is now reality (as of about a minute ago). > > There is possibly another bug in natd/libalias. Incoming ICMP packets are > being translated and forwarded if there is some "redirect address" configured > even if "deny-incoming" is specified. TCP/UDP packets are denied correctly. I > haven't had enough time to inspect this possible problem more thoroughly so I > haven't produced any PR yet. Maybe somebody else has more time ... :-) Yes, I think I noticed this when I was in there a little while ago. The DENY_INCOMING flag is only checked for incoming tcp/udp connections. > Martin > > --- > [PGP KeyID F3F409C4] -- Brian Don't _EVER_ lose your sense of humour ! To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-net" in the body of the message