RE: Source Port

["Michael K" <micke@klintan.se>]

[-- Attachment #1: Type: text/plain, Size: 1605 bytes --]

 

-----Original Message-----
From: netfilter-admin@lists.netfilter.org
[mailto:netfilter-admin@lists.netfilter.org] On Behalf Of Dharmendra.T
Sent: Tuesday, April 15, 2003 1:02 PM
To: netfilter@lists.netfilter.org
Subject: Source Port


Hi Everyone, 

I am a regular reader of this list and I have absorbed that most of the
users won't use the source ports in their rules. Say for ex, 

#iptables -A INPUT -s 192.168.1.0/24 -p tcp -d 0/0 --dport 23 -j ACCEPT 

In these kind of rules they will not specify the source port from 1024
to 65545. I strongly recommend all Linux Users to specify the exact
rules what is allowed and what is not allowed. 

Any Comments? This could be a good practise? 


-- 

Regards

Dharmendra.T





This message is intended for the addressee only. It may contain
privileged or Confidential information. If you have received this
message in error,please notify the sender and destroy the message
immediately.Unauthorised use or reproduction of this message is strictly
prohibited.

 
If you have a personal firewall (only INPUT, OUTPUT) and only ONE ip.
It's not nesecary to put --source. However if you have more than ONE ip
you could have use for the --source and --sport.
Myself always add stronger rules to my firewall using --sport --source
--destination --dport --in-interface --out-interface. And ending up with
more rules  :-(. 
I think that adding stronger rules-set make hacking harder. But will add
more administrations to the firewall.
Ex. Adding strong firewall rules to smb is a pain. But thanks to the
--state the numbers of rules will be shortend.
 
/Klintan

[-- Attachment #2: Type: text/html, Size: 3194 bytes --]