Re: firewall question

From: Crist J. Clark (cristjc@earthlink.net)
Date: 07/04/01


Date: Wed, 4 Jul 2001 01:16:23 -0700
From: "Crist J. Clark" <cristjc@earthlink.net>
To: cjclark@alum.mit.edu

On Wed, Jul 04, 2001 at 12:25:34AM -0700, Crist J. Clark wrote:
> On Tue, Jul 03, 2001 at 10:45:27AM -0400, Ralph Huntington wrote:
> > The dmesg command shows a lot of these:
> >
> > ipfw: -1 Refuse TCP W.X.Y.Z:0 A.B.C.D:0 in via fxp0
> > ipfw: -1 Refuse TCP S.T.U.V:0 A.B.C.D:0 in via fxp0
> >
> > (The uppercase letters represent the ip addresses)
> >
> > There are no rules in ipfw blocking packets from addresses W.X.Y.Z or
> > S.T.U.V to host A.B.C.D. Can someone tell me what is going on here?
>
> FINE POINTS
> o There is one kind of packet that the firewall will always discard,
> that is a TCP packet's fragment with a fragment offset of one. This
> is a valid packet, but it only has one use, to try to circumvent
> firewalls. When logging is enabled, these packets are reported as
> being dropped by rule -1.

Yuck, following up my own post.

Anyway, I just wanted to note that I committed a fix to CURRENT that
actually logs first fragments as fragments (PR 23446). It should make
logs of -1 rules a little more clear. I plan to MFC it in a few days.

-- 
Crist J. Clark                           cjclark@alum.mit.edu
To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-security" in the body of the message


Relevant Pages

  • firewall question
    ... The dmesg command shows a lot of these: ... (The uppercase letters represent the ip addresses) ... There are no rules in ipfw blocking packets from addresses W.X.Y.Z or ... with "unsubscribe freebsd-security" in the body of the message ...
    (FreeBSD-Security)
  • Re: firewall question
    ... > The dmesg command shows a lot of these: ... > (The uppercase letters represent the ip addresses) ... with "unsubscribe freebsd-security" in the body of the message ...
    (FreeBSD-Security)