Re: block port 137

[Frank Gruellich <frank@home.manuelm.org>]

* Dhananjoy Chowdhury <dhananjoy@nucleussoftware.com>  3. Aug 04:
> On Tue, 2004-08-03 at 11:47, Antony Stone wrote:
> > On Tuesday 03 August 2004 7:04 am, Dhananjoy Chowdhury wrote:
> > > try dropping packets both with dport 137 and also with sport 137.
> > I disagree.

Me too.

> Your terminology is very much true but David has already applied  the
> rule
> #iptables -A FORWARD -p udp -s 0/0 --dport 137 -j DROP
> but then also he isn't able to stop output traffic through port 137.
> So in this scenario he should appply the above rule for both --sport 
> and --dport.
> #iptables -I FORWARD -p udp -s 0/0 --dport 137 -j DROP
> #iptables -I FORWARD -p udp -s 0/0 --sport 137 -j DROP

Well, from my point of view he should add to these rules:
# iptables -P FORWARD DROP
# iptables -F FORWARD

Then he should fix his network by imaging compromised hosts for further
analysis, flatting them and installing them from trusted sources.  Later
he should look for an appropriate L.A.R.T. for the users of the machines
and maybe go online again.

YMMV,
 regards, Frank.
-- 
Sigmentation fault