Re: can I use keep-state for icmp rules?

From: Crist J. Clark (cristjc@earthlink.net)
Date: 11/02/01


Date: Thu, 1 Nov 2001 21:13:51 -0800
From: "Crist J. Clark" <cristjc@earthlink.net>
To: Greg White <gregw-freebsd-security@greg.cex.ca>

On Wed, Oct 31, 2001 at 04:09:28PM -0800, Greg White wrote:
> On Wed Oct 10/31/01, 2001 at 02:42:09PM -0800, Jason DiCioccio wrote:
> > On Wed, Oct 31, 2001 at 01:08:17PM -0800, Crist J. Clark wrote:
> > [snip]
> > > Not sure if checking more "carefully" is an accurate statement, but
> > > IPFilter does only allow TCP packets that it "expects" back in. It
> > > does track sequence numbers which ipfw(8) does not track at all.
> > [snip]
> >
> > Now I'm curious. Will using "flags S" after keep state rules in ipfilter
> > degrade the quality of ipf's stateful inspection? I know it is recommended (at
> > least on the ipfilter webpage) to use flags S for tcp keep state rules if your
> > state table is filling up, if not in all cases. I'm just curious to know
> > whether using that 'flags S' will make the inspection work more like ipfw's.
> > If so, I might have to reconsider my use of it. :-)
>
> No, cannot see how it could. 'flags S' is for the outbound connection,
> not the packets coming back.

Not really. 'flags S' will match any packet with the SYN flag
set. This would include the initial _reply_ from a remote machine
which will have both the SYN and ACK flags set.

If you only want to catch an outgoing, initial SYN, you want
'flags S/SA'.

-- 
Crist J. Clark                     |     cjclark@alum.mit.edu
                                   |     cjclark@jhu.edu
http://people.freebsd.org/~cjc/    |     cjc@freebsd.org
To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-security" in the body of the message


Relevant Pages