Re: Dropping network "noise"

[Jason Opperisano <opie@817west.com>]

On Sun, Feb 13, 2005 at 09:28:41AM +0300, Mikhail Zotov wrote:
> Hello everybody,
> 
> I have a Linux machine (with a static routable IP address)
> connected to a windoops LAN.  As is known, there is certain
> "noise" in windoops networks, which can be silently dropped
> by a rule like this:
> 
> iptables -A INPUT -p udp --dport 135:139 -j DROP
> 
> I have found that this "noise" can also be effectively blocked
> by the following rule:
> 
> iptables -A INPUT -d ! $IP.ADDRESS.OF.MY_BOX -j DROP
> 
> I haven't noticed anything going wrong yet, still I'd like to
> know: Does this rule have a (potential) drawback?  Can it break
> anything in case I have NFS or obtain IP address via DHCP or
> in any other situation?
> 
> A similar question goes for the case of a Linux router/gateway
> protecting a LAN (with machines with routable IP addresses).
> Can the following rules do any harm?
> 
> iptables -A FORWARD -i $EXTERIOR_INTERFACE -d $LAN.BROADCAST -j DROP
> iptables -A FORWARD -i $EXTERIOR_INTERFACE -d ! $LAN.IP.ADDRESSES.RANGE -j DROP

you can also use the pkttype match to drop broadcast/multicast traffic,
without having to calculate the broadcast address for every interface,
and having another rule for the all-ones broadcast:

  -m pkttype --pkt-type broadcast -j DROP
  -m pkttype --pkt-type multicast -j DROP

-j

--
"Boy, if you want anything in this life, you have to work for it. Now
 be quiet while I listen for these lottery numbers."
        --The Simpsons