Re: How to ignore incoming packets

[Sudheimer <sudix@f3g.de>]

Hi,

thanks for your hint, Mark.

> As far as I know, you can only do this if you have a static IP address.
>   Then you can filter based on your fixed ip.daddr :
> 
> ignore tcp ip.daddr=<your fixed ip>,tcp.dest=tcp.telnet
> 
> I'd also like to know of any way to accomplish this with a dynamic address!
> 
It seems to be possible to re-read the config-files with a command to
the FIFO:

   echo reset > /var/run/diald.fifo

I can do this while watching with dctrl and it seems to work fine (i.e.
without changing connection status etc.)

I have not yet tested this with a rules file with changing own IPs,
though. I am new to diald and it will probably take me quite some time
to find out how to do this (and I am a bit short of time at the moment
:-( )

According to man diald
   var ip.saddr 12
defines the IP source address of a packet. Maybe one could use something
like this on a packet send by the own system once after getting the new
own IP. (Can't imagine how, though.) 

If not, one might have to find out the own address with ifconfig ...
|grep ... after each reconnection and use the result in the rules file.

Maybe somebody more familiar with diald can help or would like to dosome
research/testing on this and report to the list...



Jaochim


-------------------------------------------------------------------------
> 
> Sudheimer wrote:
> > Hi everyone,
> >
> > I would like diald to ignore any incoming connection attempts.
> >
> > For example if I get incoming packages to my tcp port 23 (telnet), they
> > fit the default rule of diald and keep up the line for 2 minutes (keepup
> > tcp 120 any). I do not have telnetd running on this port and have also
> > an ipchains packet denying these packets.
> >
> > Nevertheless these packages match the final catch-all rule of diald and
> > keep up the line for 2 minutes (keepup tcp 120 any).
> >
> > On the other hand, I do not want to define a rule like "ignore telnet
> > packets" because this would also match my own telnet-sessions to remote
> > telnet servers.
> >
> > If it were possible for diald to distinguish between incoming and
> > outgoing packets one could say somthing like "ignore incoming tcp SYN
> > packets". Is there something like that?
> >
> >
> > Joachim