IPT Still Driving Me Nuts

IPT Still Driving Me Nuts

[David C. Hart]

[-- Attachment #1: Type: text/plain, Size: 349 bytes --]

"Nov  2 12:36:45 mail2 kernel:  -FW-  IN=eth1 OUT=
MAC=00:09:5b:22:29:d1:00:06:25:e4:ed:a3:08:00 SRC=61.172.3.25
DST=192.168.0.31 LEN=530 TOS=0x00 PREC=0x00 TTL=239 ID=21777 
PROTO=UDP SPT=32937 DPT=1026 LEN=510"

I have eliminated the virtual internal IP. The message above is still a
mismatch. That IP is on IF eth0 while it shows on eth1.

[-- Attachment #2: This is a digitally signed message part --]
[-- Type: application/pgp-signature, Size: 189 bytes --]

Re: IPT Still Driving Me Nuts

[Tom Eastep]

On Sun, 2003-11-02 at 10:00, David C. Hart wrote:
> "Nov  2 12:36:45 mail2 kernel:  -FW-  IN=eth1 OUT=
> MAC=00:09:5b:22:29:d1:00:06:25:e4:ed:a3:08:00 SRC=61.172.3.25
> DST=192.168.0.31 LEN=530 TOS=0x00 PREC=0x00 TTL=239 ID=21777 
> PROTO=UDP SPT=32937 DPT=1026 LEN=510"
> 
> I have eliminated the virtual internal IP. The message above is still a
> mismatch. That IP is on IF eth0 while it shows on eth1.

Are eth0 and eth1 connected to the same Hub/Switch?

-Tom
-- 
Tom Eastep    \ Nothing is foolproof to a sufficiently talented fool
Shoreline,     \ http://shorewall.net
Washington USA  \ teastep@shorewall.net

Re: IPT Still Driving Me Nuts

[David C. Hart]

[-- Attachment #1: Type: text/plain, Size: 507 bytes --]

On Sun, 2003-11-02 at 13:39, Tom Eastep wrote:

> Such a setup is pure "security by obscurity" since the firewall can be
> bypassed by hosts on your external subnet. Having both interfaces
> connected to the same HUB/switch also means that either interface can
> answer ARP "who-has" requests for addresses assigned to either
> interface. That's why you see the "wrong" interface accepting input
> traffic.
> 
OK. I reconfigured and pulled the plug on eth1 to the router. Let's see
what happens.

[-- Attachment #2: This is a digitally signed message part --]
[-- Type: application/pgp-signature, Size: 189 bytes --]