RE: simply confusing

["Aldo S. Lagana" <alagana@discmail.com>]

that is a bit vague...for instance if the clients' gateways are other
boxes/routers/firewalls, and your attacked client is on the same LAN as
the attackers, then your little firewall will do little to filter those
packets.   What's your infrastructure?  In other words, does your
'attacked' client reside on a separate NIC off the little firewall and
you are forwarding to it?  if so, you need to filter on the FORWARD
chain, etc.

to make a sound and viable isolated network off of a firewall, it should
reside on it's own NIC and the firewall will filter packets as they get
passed from NIC to NIC or Network to Network.

check out the Iptables tutorial for more info:
http://iptables-tutorial.haringstad.com/iptables-tutorial.html

> -----Original Message-----
> From: netfilter-admin@lists.netfilter.org 
> [mailto:netfilter-admin@lists.netfilter.org] On Behalf Of 
> Ralph Churchill
> Sent: Thursday, January 23, 2003 3:03 PM
> To: netfilter@lists.netfilter.org
> Subject: simply confusing
> 
> 
> I work at a large company and was having some fellow
> employees regularly scanning my box... so I put up a
> little firewall. Here's my one and only rule:
> 
> iptables -A INPUT --source 192.168.0.0/16 -j DROP
> 
> Now, shouldn't that block any and ALL traffic from any
> computer on the 192.168.*.* subnet? Do I need to be
> more explicit? I also have snort running and I see
> some stuff getting through... Thanks.
> 
> RMC
> 
> __________________________________________________
> Do you Yahoo!?
> Yahoo! Mail Plus - Powerful. Affordable. Sign up now. 
http://mailplus.yahoo.com