From: David Cannings <lists@edeca.net>
To: netfilter <netfilter@lists.netfilter.org>
Subject: Re: FW: Filtering multiple networks
Date: Mon, 31 May 2004 20:59:56 +0000 [thread overview]
Message-ID: <200405312059.57152.lists@edeca.net> (raw)
In-Reply-To: <20040531192351.GB26731@home.manuelm.org>
On Monday 31 May 2004 19:23, Frank Gruellich wrote:
> * David Cannings <lists@edeca.net> 31. May 04:
> > On Monday 31 May 2004 10:45, Frank Gruellich wrote:
> > Can you please explain how a TCP RST or ICMP message is supposed to
> > get back to a spoofed RFC 1918 (or otherwise reserved) address?
> What makes you think the address is spoofed? I assumed somebody just
> configured its external interface wrong. Some antique idea, that not
> all people are bad guys.
Nowadays many core routers will drop packets that appear to come from
addresses that either haven't been allocated or shouldn't be seen on the
wider Internet, therefore if packets have got as far as you something is
awry. RFC 1918 and RFC 3330 are both good references, then
http://www.iana.org/ipaddress/ip-addresses.htm.
> > Sending replies of any sort out of a WAN interface onto the Internet
> > to a reserved or private address is very bad practice.
> Yes, okay, you are right. Sorry, a reflex, when I see -j DROP.
Personally I don't know what to think on the REJECT vs DROP debate, so I
sit on the fence. Like everything else, each has advantages and
disadvantages.
> > Some would even argue that sending to unallocated space is bad.
> What do you mean with unallocated space?
IP blocks that have not been allocated by IANA or one of the regional
authorities (RIRs). This conversation is likely to go way off topic for
this list so instead I'll provide the following URL:
http://www.cymru.com/Bogons/
David
prev parent reply other threads:[~2004-05-31 20:59 UTC|newest]
Thread overview: 6+ messages / expand[flat|nested] mbox.gz Atom feed top
2004-05-31 10:32 FW: Filtering multiple networks Markus Zeilinger
2004-05-31 10:44 ` David Cannings
2004-05-31 10:45 ` Frank Gruellich
2004-05-31 13:19 ` David Cannings
2004-05-31 19:23 ` Frank Gruellich
2004-05-31 20:59 ` David Cannings [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=200405312059.57152.lists@edeca.net \
--to=lists@edeca.net \
--cc=netfilter@lists.netfilter.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.