All of lore.kernel.org
 help / color / mirror / Atom feed
From: "Simon Lodal" <simonl@mirrormind.com>
To: netfilter@lists.netfilter.org
Subject: Re: Automatic forwarding to own interfaces
Date: Tue, 23 Sep 2003 08:23:06 +0200	[thread overview]
Message-ID: <200309230823.AA53674022@mirrormind.com> (raw)

>That's a "normal" Linux behaviour. Linux answers packets destined to any
>of its own IPs own any interface, as long as your INPUT filtering rules
>allows it. You can set something like :
>
>	iptables -A INPUT -d 192.168.1.5 -i ! eth1 -j DROP
>	iptables -A OUTPUT -s 192.168.1.5 -o ! eth1 -j DROP

Hmm... I was afraid this was the case.

So in the common small scale setup with one box acting as router, firewall and internal web and smtp server, this is an absolute must. Or your "internal" web and smtp services will in fact be open to anyone.

So what is the point in configuring daemons to listen only on specific addresses?

This is probably a surprise to some, as it is to me. Quite a few firewall packages and setups miss this point.

Simon



             reply	other threads:[~2003-09-23  6:23 UTC|newest]

Thread overview: 5+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2003-09-23  6:23 Simon Lodal [this message]
2003-09-23  9:25 ` Automatic forwarding to own interfaces Martin Josefsson
     [not found] <20030923131404.11418.97793.Mailman@netfilter-sponsored-by.noris.net>
2003-09-23 13:47 ` Nik Trevallyn-Jones
  -- strict thread matches above, loose matches on Subject: below --
2003-09-23  5:14 Simon Lodal
2003-09-23  5:51 ` Cedric Blancher

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=200309230823.AA53674022@mirrormind.com \
    --to=simonl@mirrormind.com \
    --cc=netfilter@lists.netfilter.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body. 
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.