From: Rowan Reid <rreid@studio3arc.com>
To: 'Tom Eastep' <teastep@shorewall.net>
Cc: netfilter@lists.netfilter.org
Subject: RE: Internal ip exiting network on firewall external nic despight rule
Date: Fri, 20 Sep 2002 12:11:30 -0700 [thread overview]
Message-ID: <000701c260d9$871a9070$0801a8c0@s3ac> (raw)
In-Reply-To: <3D8B736D.1060808@shorewall.net>
> Rowan Reid wrote:
>
> >
> > LOG FILE ###
> > Sep 20 04:04:01 s3a-www kernel: IN=eth1 OUT=eth1 SRC=192.168.1.105
> > DST=216.99.233.76 LEN=40 TOS=0x00 PREC=0x00 TTL=127 ID=61116 DF
> > PROTO=TCP SPT=4380 DPT=110 WI NDOW=8760 RES=0x00 ACK URGP=0
>
> Note that IN and OUT both indicate eth1 -- do you perhaps
> have both NICs
> connected to the same hub/switch?
>
Yes, however my Rules are such that eth1 (External) should regect and
log external machines with an internal net address.
# remote interface, claiming to be local machines, IP spoofing, get lost
# $IPTABLES -A INPUT -i $EXTIF -s $INTNET -d $UNIVERSE -j
drop-and-log-it
Also all machines are configured such that the internal nic address
192.168.1.1 is the only gateway. Me detects a fish! My ifconfig output
Is below.
eth0 Link encap:Ethernet HWaddr 00:04:75:B1:3D:A9
inet addr:192.168.1.1 Bcast:192.168.1.255 Mask:255.255.255.0
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:67496 errors:0 dropped:0 overruns:0 frame:0
TX packets:88214 errors:0 dropped:0 overruns:0 carrier:0
collisions:5813 txqueuelen:100
RX bytes:5334404 (5.0 Mb) TX bytes:101576923 (96.8 Mb)
Interrupt:11 Base address:0x6100
eth1 Link encap:Ethernet HWaddr 00:04:75:B1:3D:6C
inet addr:**.**.76.66 Bcast:65.45.76.71 Mask:255.255.255.248
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:51089 errors:0 dropped:0 overruns:1 frame:0
TX packets:41940 errors:0 dropped:0 overruns:0 carrier:0
collisions:10 txqueuelen:100
RX bytes:37129813 (35.4 Mb) TX bytes:4338695 (4.1 Mb)
Interrupt:10 Base address:0x6200
lo Link encap:Local Loopback
inet addr:127.0.0.1 Mask:255.0.0.0
UP LOOPBACK RUNNING MTU:16436 Metric:1
RX packets:13 errors:0 dropped:0 overruns:0 frame:0
TX packets:13 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:0
RX bytes:1374 (1.3 Kb) TX bytes:1374 (1.3 Kb)
next prev parent reply other threads:[~2002-09-20 19:11 UTC|newest]
Thread overview: 23+ messages / expand[flat|nested] mbox.gz Atom feed top
2002-09-20 18:37 Internal ip exiting network on firewall external nic despight rule Rowan Reid
2002-09-20 19:05 ` Antony Stone
2002-09-20 20:59 ` Rowan Reid
2002-09-20 21:36 ` Antony Stone
2002-09-20 21:58 ` Rowan Reid
2002-09-20 22:43 ` Antony Stone
2002-09-20 23:10 ` Rowan Reid
2002-09-20 23:32 ` Antony Stone
2002-09-20 19:13 ` Tom Eastep
2002-09-20 19:11 ` Rowan Reid [this message]
2002-09-20 19:34 ` Antony Stone
2002-09-20 19:40 ` Tom Eastep
2002-09-20 21:24 ` Rowan Reid
2002-09-20 21:54 ` Antony Stone
2002-09-20 22:26 ` Rowan Reid
2002-09-20 23:01 ` Antony Stone
2002-09-20 23:13 ` Rowan Reid
2002-09-20 23:37 ` Antony Stone
2002-09-21 1:00 ` Tom Eastep
2002-09-21 13:01 ` Anders Fugmann
2002-09-20 19:36 ` Tom Eastep
2002-09-20 19:53 ` Alistair Tonner
[not found] <000d01c260e8$df710380$0801a8c0@s3ac>
2002-09-20 21:44 ` Antony Stone
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to='000701c260d9$871a9070$0801a8c0@s3ac' \
--to=rreid@studio3arc.com \
--cc=netfilter@lists.netfilter.org \
--cc=teastep@shorewall.net \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox