From: Tom Eastep <teastep@shorewall.net>
To: Rowan Reid <rreid@studio3arc.com>
Cc: netfilter@lists.netfilter.org
Subject: Re: Internal ip exiting network on firewall external nic despight rule
Date: Fri, 20 Sep 2002 12:36:38 -0700 [thread overview]
Message-ID: <3D8B78C6.1000408@shorewall.net> (raw)
In-Reply-To: 000701c260d9$871a9070$0801a8c0@s3ac
[-- Attachment #1: Type: text/plain, Size: 1320 bytes --]
Rowan Reid wrote:
>>Rowan Reid wrote:
>>
>>
>>>LOG FILE ###
>>>Sep 20 04:04:01 s3a-www kernel: IN=eth1 OUT=eth1 SRC=192.168.1.105
>>>DST=216.99.233.76 LEN=40 TOS=0x00 PREC=0x00 TTL=127 ID=61116 DF
>>>PROTO=TCP SPT=4380 DPT=110 WI NDOW=8760 RES=0x00 ACK URGP=0
>>
>>Note that IN and OUT both indicate eth1 -- do you perhaps
>>have both NICs
>>connected to the same hub/switch?
>>
>
>
> Yes, however my Rules are such that eth1 (External) should regect and
> log external machines with an internal net address.
> # remote interface, claiming to be local machines, IP spoofing, get lost
> # $IPTABLES -A INPUT -i $EXTIF -s $INTNET -d $UNIVERSE -j
> drop-and-log-it
But the packet logged above never goes near the INPUT flter table chain --
it goes through the FORWARD chain. Once you plug that hole then you'll
start having stalls due to the way that the Linux kernel handles ARP
who-has requests (the response can come from any interface connected to
the switch/hub). There was a solution for this problem on the 2.2 kernels
('hidden' interface flag) but last time that I researched it, there was no
solution on 2.4. Someone correct me please if I'm wrong about that...
-Tom
--
Tom Eastep \ Shorewall - iptables made easy
AIM: tmeastep \ http://www.shorewall.net
ICQ: #60745924 \ teastep@shorewall.net
[-- Attachment #2: S/MIME Cryptographic Signature --]
[-- Type: application/x-pkcs7-signature, Size: 3257 bytes --]
next prev parent reply other threads:[~2002-09-20 19:36 UTC|newest]
Thread overview: 23+ messages / expand[flat|nested] mbox.gz Atom feed top
2002-09-20 18:37 Internal ip exiting network on firewall external nic despight rule Rowan Reid
2002-09-20 19:05 ` Antony Stone
2002-09-20 20:59 ` Rowan Reid
2002-09-20 21:36 ` Antony Stone
2002-09-20 21:58 ` Rowan Reid
2002-09-20 22:43 ` Antony Stone
2002-09-20 23:10 ` Rowan Reid
2002-09-20 23:32 ` Antony Stone
2002-09-20 19:13 ` Tom Eastep
2002-09-20 19:11 ` Rowan Reid
2002-09-20 19:34 ` Antony Stone
2002-09-20 19:40 ` Tom Eastep
2002-09-20 21:24 ` Rowan Reid
2002-09-20 21:54 ` Antony Stone
2002-09-20 22:26 ` Rowan Reid
2002-09-20 23:01 ` Antony Stone
2002-09-20 23:13 ` Rowan Reid
2002-09-20 23:37 ` Antony Stone
2002-09-21 1:00 ` Tom Eastep
2002-09-21 13:01 ` Anders Fugmann
2002-09-20 19:36 ` Tom Eastep [this message]
2002-09-20 19:53 ` Alistair Tonner
[not found] <000d01c260e8$df710380$0801a8c0@s3ac>
2002-09-20 21:44 ` Antony Stone
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=3D8B78C6.1000408@shorewall.net \
--to=teastep@shorewall.net \
--cc=netfilter@lists.netfilter.org \
--cc=rreid@studio3arc.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox