Re: External IP addresses on internal network

[Jeffrey Laramie <JALaramie@Loudoun-Fairfax.com>]

Hey Mike,

Michael J. Tubby B.Sc. (Hons) G8TIC wrote:

>What you should be filtering is packet egress, that is your 192.168 or
>whatever internal LAN leaking 'naked' (un-NATted) to the internet at
>large.
>  
>
Yes, I do this. I also filter coming from the LAN on the INPUT table 
since I consider any box a potential risk.

>I do this in two places, on the main firewall box between out "inside"
>and "outside" in iptables and then again at the Cisco router facing
>PSInet with an ACL that drop & log any packets from anything other
>than our PSInet Class-C, so there's no way we can "leak" on to the 'net.
>  
>
My DSL provider owns and maintains my router. I never thought about 
filtering at the router. Hmm, I'll have to ask about that.

Jeff