From mboxrd@z Thu Jan 1 00:00:00 1970 From: Sudheimer Subject: Re: How to ignore incoming packets Date: Thu, 28 Aug 2003 10:19:04 +0200 Sender: linux-diald-owner@vger.kernel.org Message-ID: <3F4DBAF8.BBF8B7FA@f3g.de> References: <3F4CBDEC.6F623298@f3g.de> <3F4D244B.1030109@sympatico.ca> Mime-Version: 1.0 Content-Transfer-Encoding: 7bit Return-path: List-Id: Content-Type: text/plain; charset="us-ascii" To: linux-diald@vger.kernel.org Hi, thanks for your hint, Mark. > As far as I know, you can only do this if you have a static IP address. > Then you can filter based on your fixed ip.daddr : > > ignore tcp ip.daddr=,tcp.dest=tcp.telnet > > I'd also like to know of any way to accomplish this with a dynamic address! > It seems to be possible to re-read the config-files with a command to the FIFO: echo reset > /var/run/diald.fifo I can do this while watching with dctrl and it seems to work fine (i.e. without changing connection status etc.) I have not yet tested this with a rules file with changing own IPs, though. I am new to diald and it will probably take me quite some time to find out how to do this (and I am a bit short of time at the moment :-( ) According to man diald var ip.saddr 12 defines the IP source address of a packet. Maybe one could use something like this on a packet send by the own system once after getting the new own IP. (Can't imagine how, though.) If not, one might have to find out the own address with ifconfig ... |grep ... after each reconnection and use the result in the rules file. Maybe somebody more familiar with diald can help or would like to dosome research/testing on this and report to the list... Jaochim ------------------------------------------------------------------------- > > Sudheimer wrote: > > Hi everyone, > > > > I would like diald to ignore any incoming connection attempts. > > > > For example if I get incoming packages to my tcp port 23 (telnet), they > > fit the default rule of diald and keep up the line for 2 minutes (keepup > > tcp 120 any). I do not have telnetd running on this port and have also > > an ipchains packet denying these packets. > > > > Nevertheless these packages match the final catch-all rule of diald and > > keep up the line for 2 minutes (keepup tcp 120 any). > > > > On the other hand, I do not want to define a rule like "ignore telnet > > packets" because this would also match my own telnet-sessions to remote > > telnet servers. > > > > If it were possible for diald to distinguish between incoming and > > outgoing packets one could say somthing like "ignore incoming tcp SYN > > packets". Is there something like that? > > > > > > Joachim