From: Marco Gaiarin <gaio@sv.lnf.it>
To: lartc@vger.kernel.org
Subject: Re: Multiple link, policy routing and link not in defaut route...
Date: Mon, 08 Feb 2021 15:15:30 +0000 [thread overview]
Message-ID: <20210208151530.GO3103@sv.lnf.it> (raw)
In-Reply-To: <20210203181530.GO3370@lilliput.linux.it>
Mandi! cronolog+lartc
In chel di` si favelave...
> Rather than disable rp_filter (by setting to 0 on all interfaces I presume),
> what about setting it to 2 for Loose mode instead, and only on the affected
> interfaces, so only those interfaces change behaviour?
> Loose mode would allow the packet as long as there is a valid route on any
> interface, instead of the specific interface it comes in. So as long as a
> default route exists anywhere, the packet should pass.
Bingo!
> Potentially this opens up the interface to spoofed traffic, as it would now
> allow traffic with source IP belonging to subnets on your private interfaces,
> because obviously you would have routes to those too. But that can be solved
> easily with iptables rules. Generally I block all packets with source in all
> private IP ranges on Internet-facing interfaces, with exceptions if necessary
> e.g. for external DMZ etc.
I do exactly the same things. To at least have notices, i've also
enabled 'log_martians'.
Many thanks!!!
--
dott. Marco Gaiarin GNUPG Key ID: 240A3D66
Associazione ``La Nostra Famiglia'' http://www.lanostrafamiglia.it/
Polo FVG - Via della Bontà, 7 - 33078 - San Vito al Tagliamento (PN)
marco.gaiarin(at)lanostrafamiglia.it t +39-0434-842711 f +39-0434-842797
Dona il 5 PER MILLE a LA NOSTRA FAMIGLIA!
http://www.lanostrafamiglia.it/index.php/it/sostienici/5x1000
(cf 00307430132, categoria ONLUS oppure RICERCA SANITARIA)
next prev parent reply other threads:[~2021-02-08 15:15 UTC|newest]
Thread overview: 6+ messages / expand[flat|nested] mbox.gz Atom feed top
2021-02-03 18:15 Multiple link, policy routing and link not in defaut route Marco Gaiarin
2021-02-05 16:42 ` Marco Gaiarin
2021-02-06 10:30 ` cronolog+lartc
2021-02-08 15:15 ` Marco Gaiarin [this message]
2021-02-09 1:47 ` Jay Vosburgh
2021-02-09 17:54 ` Marco Gaiarin
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20210208151530.GO3103@sv.lnf.it \
--to=gaio@sv.lnf.it \
--cc=lartc@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.