From mboxrd@z Thu Jan 1 00:00:00 1970 From: "Dharmendra.T" Subject: Source Port Date: 15 Apr 2003 16:32:13 +0530 Sender: netfilter-admin@lists.netfilter.org Message-ID: <1050404537.1482.19.camel@india> Mime-Version: 1.0 Content-Type: multipart/alternative; boundary="=-Poumfq+7UIPIuWfdlR4r" Return-path: Errors-To: netfilter-admin@lists.netfilter.org List-Help: List-Post: List-Subscribe: , List-Id: List-Unsubscribe: , List-Archive: To: netfilter@lists.netfilter.org --=-Poumfq+7UIPIuWfdlR4r Content-Type: text/plain Content-Transfer-Encoding: 7bit Hi Everyone, I am a regular reader of this list and I have absorbed that most of the users won't use the source ports in their rules. Say for ex, #iptables -A INPUT -s 192.168.1.0/24 -p tcp -d 0/0 --dport 23 -j ACCEPT In these kind of rules they will not specify the source port from 1024 to 65545. I strongly recommend all Linux Users to specify the exact rules what is allowed and what is not allowed. Any Comments? This could be a good practise? -- Regards Dharmendra.T This message is intended for the addressee only. It may contain privileged or Confidential information. If you have received this message in error,please notify the sender and destroy the message immediately.Unauthorised use or reproduction of this message is strictly prohibited. --=-Poumfq+7UIPIuWfdlR4r Content-Type: text/html; charset=utf-8 Hi Everyone,

I am a regular reader of this list and I have absorbed that most of the users won't use the source ports in their rules. Say for ex,

#iptables -A INPUT -s 192.168.1.0/24 -p tcp -d 0/0 --dport 23 -j ACCEPT

In these kind of rules they will not specify the source port from 1024 to 65545. I strongly recommend all Linux Users to specify the exact rules what is allowed and what is not allowed.

Any Comments? This could be a good practise? 
-- 
Regards
Dharmendra.T


This message is intended for the addressee only. It may contain privileged or Confidential information. If you have received this message in error,please notify the sender and destroy the message immediately.Unauthorised use or reproduction of this message is strictly prohibited.
--=-Poumfq+7UIPIuWfdlR4r-- From mboxrd@z Thu Jan 1 00:00:00 1970 From: Raymond Leach Subject: Re: Source Port Date: 15 Apr 2003 13:11:26 +0200 Sender: netfilter-admin@lists.netfilter.org Message-ID: <1050405086.1439.47.camel@raylinux.internal> References: <1050404537.1482.19.camel@india> Reply-To: raymondl@knowledgefactory.co.za Mime-Version: 1.0 Content-Type: multipart/signed; micalg=pgp-sha1; protocol="application/pgp-signature"; boundary="=-PWXAI5uznK8PTqsjnBu9" Return-path: In-Reply-To: <1050404537.1482.19.camel@india> Errors-To: netfilter-admin@lists.netfilter.org List-Help: List-Post: List-Subscribe: , List-Id: List-Unsubscribe: , List-Archive: To: Netfilter Mailing List --=-PWXAI5uznK8PTqsjnBu9 Content-Type: text/plain Content-Transfer-Encoding: quoted-printable Why? In the specific example that you give, what would be the implications? On Tue, 2003-04-15 at 13:02, Dharmendra.T wrote: > Hi Everyone,=20 >=20 > I am a regular reader of this list and I have absorbed that most of > the users won't use the source ports in their rules. Say for ex,=20 >=20 > #iptables -A INPUT -s 192.168.1.0/24 -p tcp -d 0/0 --dport 23 -j > ACCEPT=20 >=20 > In these kind of rules they will not specify the source port from 1024 > to 65545. I strongly recommend all Linux Users to specify the exact > rules what is allowed and what is not allowed.=20 >=20 > Any Comments? This could be a good practise?=20 > --=20 > Regards > Dharmendra.T >=20 >=20 > This message is intended for the addressee only. It may contain privilege= d or Confidential information. If you have received this message in error,p= lease notify the sender and destroy the message immediately.Unauthorised us= e or reproduction of this message is strictly prohibited. --=-PWXAI5uznK8PTqsjnBu9 Content-Type: application/pgp-signature; name=signature.asc Content-Description: This is a digitally signed message part -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.1 (GNU/Linux) iD8DBQA+m+jeh1fuR/Bv+ygRAmNyAJ0VyXt+IvEMunbGVGIpHiOPwIcZCgCdEbSL S0T+wh04QtNKERUwY93evGs= =8xyv -----END PGP SIGNATURE----- --=-PWXAI5uznK8PTqsjnBu9-- From mboxrd@z Thu Jan 1 00:00:00 1970 From: "Dharmendra.T" Subject: Re: Source Port Date: 15 Apr 2003 18:20:33 +0530 Sender: netfilter-admin@lists.netfilter.org Message-ID: <1050411060.6649.1.camel@india> References: <1050404537.1482.19.camel@india> <1050405086.1439.47.camel@raylinux.internal> Mime-Version: 1.0 Content-Type: multipart/alternative; boundary="=-Ntpz07aWYKw9LRbQFf4M" Return-path: In-Reply-To: <1050405086.1439.47.camel@raylinux.internal> Errors-To: netfilter-admin@lists.netfilter.org List-Help: List-Post: List-Subscribe: , List-Id: List-Unsubscribe: , List-Archive: To: Netfilter Mailing List --=-Ntpz07aWYKw9LRbQFf4M Content-Type: text/plain Content-Transfer-Encoding: 7bit Yes, That is how the applications work. The server will connect to the client's arbitrary ports for communication except some cases. On Tue, 2003-04-15 at 16:41, Raymond Leach wrote: Why? In the specific example that you give, what would be the implications? On Tue, 2003-04-15 at 13:02, Dharmendra.T wrote: > Hi Everyone, > > I am a regular reader of this list and I have absorbed that most of > the users won't use the source ports in their rules. Say for ex, > > #iptables -A INPUT -s 192.168.1.0/24 -p tcp -d 0/0 --dport 23 -j > ACCEPT > > In these kind of rules they will not specify the source port from 1024 > to 65545. I strongly recommend all Linux Users to specify the exact > rules what is allowed and what is not allowed. > > Any Comments? This could be a good practise? > -- > Regards > Dharmendra.T > > > This message is intended for the addressee only. It may contain privileged or Confidential information. If you have received this message in error,please notify the sender and destroy the message immediately.Unauthorised use or reproduction of this message is strictly prohibited. -- Regards Dharmendra.T This message is intended for the addressee only. It may contain privileged or Confidential information. If you have received this message in error,please notify the sender and destroy the message immediately.Unauthorised use or reproduction of this message is strictly prohibited. --=-Ntpz07aWYKw9LRbQFf4M Content-Type: text/html; charset=utf-8 Yes, That is how the applications work. The server will connect to the client's arbitrary ports for communication except some cases.



On Tue, 2003-04-15 at 16:41, Raymond Leach wrote: 
Why? In the specific example that you give, what would be the
implications?


On Tue, 2003-04-15 at 13:02, Dharmendra.T wrote:
> Hi Everyone, 
> 
> I am a regular reader of this list and I have absorbed that most of
> the users won't use the source ports in their rules. Say for ex, 
> 
> #iptables -A INPUT -s 192.168.1.0/24 -p tcp -d 0/0 --dport 23 -j
> ACCEPT 
> 
> In these kind of rules they will not specify the source port from 1024
> to 65545. I strongly recommend all Linux Users to specify the exact
> rules what is allowed and what is not allowed. 
> 
> Any Comments? This could be a good practise? 
> -- 
> Regards
> Dharmendra.T
> 
> 
> This message is intended for the addressee only. It may contain privileged or Confidential information. If you have received this message in error,please notify the sender and destroy the message immediately.Unauthorised use or reproduction of this message is strictly prohibited.


-- 
Regards
Dharmendra.T


This message is intended for the addressee only. It may contain privileged or Confidential information. If you have received this message in error,please notify the sender and destroy the message immediately.Unauthorised use or reproduction of this message is strictly prohibited.
--=-Ntpz07aWYKw9LRbQFf4M-- From mboxrd@z Thu Jan 1 00:00:00 1970 From: "Michael K" Subject: RE: Source Port Date: Tue, 15 Apr 2003 17:22:34 +0200 Sender: netfilter-admin@lists.netfilter.org Message-ID: <001101c30362$d75d4c40$0200a8c0@klintan.local> References: <1050404537.1482.19.camel@india> Mime-Version: 1.0 Content-Type: multipart/alternative; boundary="----=_NextPart_000_0012_01C30373.9AE61C40" Return-path: In-Reply-To: <1050404537.1482.19.camel@india> Errors-To: netfilter-admin@lists.netfilter.org List-Help: List-Post: List-Subscribe: , List-Id: List-Unsubscribe: , List-Archive: To: netfilter@lists.netfilter.org This is a multi-part message in MIME format. ------=_NextPart_000_0012_01C30373.9AE61C40 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit -----Original Message----- From: netfilter-admin@lists.netfilter.org [mailto:netfilter-admin@lists.netfilter.org] On Behalf Of Dharmendra.T Sent: Tuesday, April 15, 2003 1:02 PM To: netfilter@lists.netfilter.org Subject: Source Port Hi Everyone, I am a regular reader of this list and I have absorbed that most of the users won't use the source ports in their rules. Say for ex, #iptables -A INPUT -s 192.168.1.0/24 -p tcp -d 0/0 --dport 23 -j ACCEPT In these kind of rules they will not specify the source port from 1024 to 65545. I strongly recommend all Linux Users to specify the exact rules what is allowed and what is not allowed. Any Comments? This could be a good practise? -- Regards Dharmendra.T This message is intended for the addressee only. It may contain privileged or Confidential information. If you have received this message in error,please notify the sender and destroy the message immediately.Unauthorised use or reproduction of this message is strictly prohibited. If you have a personal firewall (only INPUT, OUTPUT) and only ONE ip. It's not nesecary to put --source. However if you have more than ONE ip you could have use for the --source and --sport. Myself always add stronger rules to my firewall using --sport --source --destination --dport --in-interface --out-interface. And ending up with more rules :-(. I think that adding stronger rules-set make hacking harder. But will add more administrations to the firewall. Ex. Adding strong firewall rules to smb is a pain. But thanks to the --state the numbers of rules will be shortend. /Klintan ------=_NextPart_000_0012_01C30373.9AE61C40 Content-Type: text/html; charset="us-ascii" Content-Transfer-Encoding: quoted-printable Meddelande
 
-----Original Message-----
From:=20 netfilter-admin@lists.netfilter.org=20 [mailto:netfilter-admin@lists.netfilter.org] On Behalf Of=20 Dharmendra.T
Sent: Tuesday, April 15, 2003 1:02 = PM
To:=20 netfilter@lists.netfilter.org
Subject: Source=20 Port

Hi Everyone,

I am a regular reader of = this=20 list and I have absorbed that most of the users won't use the source = ports in=20 their rules. Say for ex,

#iptables -A INPUT -s 192.168.1.0/24 = -p tcp=20 -d 0/0 --dport 23 -j ACCEPT

In these kind of rules they will = not=20 specify the source port from 1024 to 65545. I strongly recommend all = Linux=20 Users to specify the exact rules what is allowed and what is not = allowed.=20

Any Comments? This could be a good practise? 
--=20
Regards
Dharmendra.T


This message is intended for the addressee only. It may contain =
privileged or Confidential information. If you have received this =
message in error,please notify the sender and destroy the message =
immediately.Unauthorised use or reproduction of this message is strictly =
prohibited.
 
If you=20 have a personal firewall (only INPUT, OUTPUT) and only ONE ip. It's=20 not nesecary to put --source. However if you have = more than ONE=20 ip you could have use for the --source and --sport.
Myself=20 always add stronger rules to my firewall using --sport --source = --destination=20 --dport --in-interface --out-interface. And ending up with = more=20 rules  :-(.=20
I=20 think that adding stronger rules-set make hacking harder. But will add = more=20 administrations to the firewall.
Ex.=20 Adding strong firewall rules to smb is a pain. But thanks to the --state = the=20 numbers of rules will be shortend.
 
/Klintan
------=_NextPart_000_0012_01C30373.9AE61C40-- From mboxrd@z Thu Jan 1 00:00:00 1970 From: Julian Gomez Subject: Re: Source Port Date: Wed, 16 Apr 2003 15:26:47 +0800 Sender: netfilter-admin@lists.netfilter.org Message-ID: <20030416072647.GB3806@floyd> Reply-To: kluivert@tm.net.my Mime-Version: 1.0 Return-path: Content-Disposition: inline Errors-To: netfilter-admin@lists.netfilter.org List-Help: List-Post: List-Subscribe: , List-Id: List-Unsubscribe: , List-Archive: Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit To: netfilter@lists.netfilter.org On Tue, Apr 15, 2003 at 04:32:13PM +0530, Dharmendra.T spoke thusly: >#iptables -A INPUT -s 192.168.1.0/24 -p tcp -d 0/0 --dport 23 -j ACCEPT For this case, it doesn't matter because I doubt your telnet binary will be using 1-1024 ports for the outgoing telnet session initiation. It'll need to be setuid to make the bind() call I think (Unix systems). >Any Comments? This could be a good practise? For other services, yes it can be tied down further. IKE traffic is for source (UDP 500) <-> destination (UDP 500). I vaguely remember NTP also being tied down to port 123, but that might have been specific to my configuration settings, or even my source package. I think there was (?) a tunable setting in /proc which can determine which outgoing port numbers should be used, and it'll recycle the numbers by itself. If you are unlucky enough to be using (puke :-) MS Exchange, and your users require access remotely -- it requires full 1-65535 (or close enough) filter rules to be left wide open, unless you tweak the registry settings to limit the port ranges. It makes sense there. -- "any nation that wants to control its borders can do so." - Tommy Franks; Mexicans && Columbia Drug War ? From mboxrd@z Thu Jan 1 00:00:00 1970 From: "Michael K" Subject: RE: Source Port Date: Wed, 16 Apr 2003 12:07:02 +0200 Sender: netfilter-admin@lists.netfilter.org Message-ID: <000601c303ff$ed234000$0200a8c0@klintan.local> References: <20030416072647.GB3806@floyd> Mime-Version: 1.0 Content-Transfer-Encoding: 7bit Return-path: In-Reply-To: <20030416072647.GB3806@floyd> Errors-To: netfilter-admin@lists.netfilter.org List-Help: List-Post: List-Subscribe: , List-Id: List-Unsubscribe: , List-Archive: Content-Type: text/plain; charset="us-ascii" To: netfilter@lists.netfilter.org --snip-- > I think there was (?) a tunable setting in /proc which can > determine which outgoing port numbers should be used, and > it'll recycle the numbers by itself. Sure thing. Go to http://ipsysctl-tutorial.frozentux.net/ipsysctl-tutorial.html#AEN269 --snip--- /Klintan From mboxrd@z Thu Jan 1 00:00:00 1970 From: "Dharmendra.T" Subject: RE: Source Port Date: 16 Apr 2003 16:42:09 +0530 Sender: netfilter-admin@lists.netfilter.org Message-ID: <1050491551.2953.13.camel@india> References: <000601c303ff$ed234000$0200a8c0@klintan.local> Mime-Version: 1.0 Content-Type: multipart/alternative; boundary="=-8Di+7IMPpP0prz3AfIy3" Return-path: In-Reply-To: <000601c303ff$ed234000$0200a8c0@klintan.local> Errors-To: netfilter-admin@lists.netfilter.org List-Help: List-Post: List-Subscribe: , List-Id: List-Unsubscribe: , List-Archive: To: netfilter@lists.netfilter.org --=-8Di+7IMPpP0prz3AfIy3 Content-Type: text/plain Content-Transfer-Encoding: 7bit On Wed, 2003-04-16 at 15:37, Michael K wrote: --snip-- > I think there was (?) a tunable setting in /proc which can > determine which outgoing port numbers should be used, and > it'll recycle the numbers by itself. Sure thing. Go to http://ipsysctl-tutorial.frozentux.net/ipsysctl-tutorial.html#AEN269 --snip--- /Klintan Yes, this is nice one. -- Regards Dharmendra.T This message is intended for the addressee only. It may contain privileged or Confidential information. If you have received this message in error,please notify the sender and destroy the message immediately.Unauthorised use or reproduction of this message is strictly prohibited. --=-8Di+7IMPpP0prz3AfIy3 Content-Type: text/html; charset=utf-8 On Wed, 2003-04-16 at 15:37, Michael K wrote: 
--snip--
> I think there was (?) a tunable setting in /proc which can 
> determine which outgoing port numbers should be used, and 
> it'll recycle the numbers by itself.

Sure thing. Go to
http://ipsysctl-tutorial.frozentux.net/ipsysctl-tutorial.html#AEN269
 
--snip---

/Klintan
Yes, this is nice one. 
-- 
Regards
Dharmendra.T


This message is intended for the addressee only. It may contain privileged or Confidential information. If you have received this message in error,please notify the sender and destroy the message immediately.Unauthorised use or reproduction of this message is strictly prohibited.
--=-8Di+7IMPpP0prz3AfIy3--