/* HINT: Search archives @ http://www.indyramp.com/masq/ before posting! */
Thanks for the response.
> # remote interface, claiming to be local machines, IP spoofing, get lost
> ipchains -A input -i $extint -s $intnet -d 0.0.0.0/0 -l -j REJECT
The way I read this rule is as follws :
Add an input rule
REJECT all packets coming from the external interface with a source
IP of the internal network and destination
of anywhere.
This is probably a lack of understanding on my part, but for the -d
do I have to have the external interface IP address/subnet mask?
I would have thought that if I ping'd an outside address, this rule
would not be met, since when my ping response goes out, and when the
response comes back in, the source wouldn't be the external network so the
packet would be let
back in.
Scott
-----Original Message-----
From: Fuzzy Fox [mailto:[EMAIL PROTECTED]]
Sent: Tuesday, November 09, 1999 6:05 PM
To: Scott Brause
Cc: [EMAIL PROTECTED]
Subject: Re: IPCHAINS strong ruleset problems
Scott Brause <[EMAIL PROTECTED]> wrote:
>
> intnet="10.0.0.0/0"
> extint="eth0"
> # remote interface, claiming to be local machines, IP spoofing, get lost
> ipchains -A input -i $extint -s $intnet -d 0.0.0.0/0 -l -j REJECT
Is that really a "/0" describing "intnet"?? By giving it 0 bits for the
network portion, you are basically causing this rule to match *any* IP
address! So your rejection rule rejects everything that comes in.
I think you either meant "/24", or perhaps "/8", instead.
--
[EMAIL PROTECTED] (Fuzzy Fox) || "Good judgment comes from experience.
sometimes known as David DeSimone || Experience comes from bad judgment."
http://www.dallas.net/~fox/ || -- Life Lessons
_______________________________________________
Masq maillist - [EMAIL PROTECTED]
Admin requests can be handled at http://www.indyramp.com/masq-list/ -- THIS INCLUDES
UNSUBSCRIBING!
or email to [EMAIL PROTECTED]
PLEASE read the HOWTO and search the archives before posting.
You can start your search at http://www.indyramp.com/masq/
Please keep general linux/unix/pc/internet questions off the list.
