Date: Wed, 21 Mar 2001 21:10:35 +0000 From: Paul Richards <paul@freebsd-services.co.uk> To: Bill Fumerola <billf@mu.org> Cc: Paul Richards <paul@FreeBSD.org>, cvs-committers@FreeBSD.org, cvs-all@FreeBSD.org Subject: Re: cvs commit: src/sys/netinet ip_fw.c Message-ID: <3AB918CB.33EC9A98@freebsd-services.co.uk> References: <200103210819.f2L8JWm19214@freefall.freebsd.org> <20010321150244.F2567@elvis.mu.org>
next in thread | previous in thread | raw e-mail | index | archive | help
Bill Fumerola wrote: > > On Wed, Mar 21, 2001 at 12:19:32AM -0800, Paul Richards wrote: > > > Modified files: > > sys/netinet ip_fw.c > > Log: > > Only flush rules that have a rule number above that set by a new > > sysctl, net.inet.ip.fw.permanent_rules. > > > > This allows you to install rules that are persistent across flushes, > > which is very useful if you want a default set of rules that > > maintains your access to remote machines while you're reconfiguring > > the other rules. > > > > Reviewed by: Mark Murray <markm@FreeBSD.org> > > Ugh. > > If you're configuring remote machines with a default deny rule instead > of explcitly adding a deny rule you might want to reconsider. Explain? Configuring *any* server without a default deny rule is more foolhardy because there's a window of opportunity for a hacker before the rules are applied. Paul. To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe cvs-all" in the body of the message
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?3AB918CB.33EC9A98>