Date: Thu, 19 Sep 2002 11:14:01 -0700 From: "Crist J. Clark" <crist.clark@attbi.com> To: Adrian Penisoara <ady@freebsd.ady.ro> Cc: freebsd-net@FreeBSD.ORG, freebsd-hackers@FreeBSD.ORG Subject: Re: Desired feature: ipfw pass for routed IPs Message-ID: <20020919181401.GA18752@blossom.cjclark.org> In-Reply-To: <Pine.BSF.4.10.10209191054220.82837-100000@ady.warpnet.ro> References: <Pine.BSF.4.10.10209191054220.82837-100000@ady.warpnet.ro>
next in thread | previous in thread | raw e-mail | index | archive | help
On Thu, Sep 19, 2002 at 11:07:07AM +0300, Adrian Penisoara wrote:
> Hi,
>
> When building anti-spoofing firewall rules on a routing server it
> would be very helpfull to have a way to tell ipfw (or other firewalling
> mechanisms) to pass all pachets that the source or destination IP has a
> valid (static/daemon) routing entry in the kernel.
>
> Something maybe like:
>
> ipfw add allow ip from any to any routed static via xl0
> ipfw add deny ip from any to any via xl0
>
> The 'routed' keyword should accept route associated flags (like those
> listed in route(8)). That would be a desired feature too, because some
> routing daemons mark their routes in a different way (for example Zebra
> brings up the RTF_PROTO1 flag on its routes).
>
> It's been said that iproute2 in the recent Linux kernels alreay
> support this, but I haven't checked out closely.
>
> How hard would that be to implement ?
On input packets, it'd be painful and not really practical. On output
packets, it shouldn't be _too_ bad since the routing information would
be available.
I'm not quite sure I understand why it would be needed. If there isn't
a route to send a packet out of an interface, it won't go out of the
interface. Under what conditions would you see yourself blocking
packets? Is this really an ackbassward way to filter routes from
routing daemons?
--
Crist J. Clark | cjclark@alum.mit.edu
| cjclark@jhu.edu
http://people.freebsd.org/~cjc/ | cjc@freebsd.org
To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-hackers" in the body of the message
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20020919181401.GA18752>