Re: Best way to filter "Nachi pings"?

From: Peter C. Lai (sirmoo_at_cowbert.2y.net)
Date: 10/27/03

  • Next message: G Hasse: "Re: hardware crypto and SSL?" 
    Date: Mon, 27 Oct 2003 14:22:35 -0500
To: Brett Glass <brett@lariat.org>

    will the new IPFW2 build as a KLM which you could use with your old freebsd
    kernel? (/sbin/ipfw2 would have to be rebuilt also, but should be otherwise
    compatible).

    Similarly, is there a reason that you wouldn't be able to use the less robust
    ipfw2 on your release (since I assume you'd be using it purely for its iplen
    capabilities)? In any case, blocking ICMP etc. appears to be operationally
    the same as introducing unstable ipfw2 into a stable running kernel - they
    are at best, only temporary solutions.

    On Mon, Oct 27, 2003 at 06:17:26AM -0700, Brett Glass wrote:
    > At 02:34 AM 10/27/2003, Kris Kennaway wrote:
    >
    > >As it happens, ipfw[2] does this anyway.
    >
    > It does. But the router is a production machine and is
    > running an older release of FreeBSD that doesn't have
    > a solid IPFW2. (IPFW2 *just* hit full production quality
    > somewhere between 4.8-RELEASE and now, I must wait until
    > 4.9-RELEASE is out, and proves stable, before I can start
    > using IPFW2. This, as you know, may take awhile.)
    >
    > --Brett
    >
    > _______________________________________________
    > freebsd-security@freebsd.org mailing list
    > http://lists.freebsd.org/mailman/listinfo/freebsd-security
    > To unsubscribe, send any mail to "freebsd-security-unsubscribe@freebsd.org" 

    -- 
Peter C. Lai
University of Connecticut
Dept. of Molecular and Cell Biology
Yale University School of Medicine
SenseLab | Research Assistant
http://cowbert.2y.net/
_______________________________________________
freebsd-security@freebsd.org mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-security
To unsubscribe, send any mail to "freebsd-security-unsubscribe@freebsd.org"
  • Next message: G Hasse: "Re: hardware crypto and SSL?"

    Relevant Pages

    • Cannot get a raw ESP socket with IPFW2 enabled
      ... I have problems getting a raw ESP socket on a FreeBSD 4.10-RELEASE (and ... But without IPFW2 it works: ... The complete kernel config file can be found under ...
      (freebsd-stable)
    • Re: [from newbies] RE: IPFW2 + 4.10
      ... IPFW2 is not compiled into 4.10 by default. ... At a shell, type "man ipfw", ... then a single forward slash (to bring up the search tool), ... ipfw2 is standard in FreeBSD CURRENT, ...
      (freebsd-questions)
    • Error compiling ipfw2 on FreeBSD 4.11-RELEASE and 4.11-p10
      ... I have upgraded from FreeBSD 4.7 to 4.11-RELEASE via booting from CD 1. ... I have IPFW2 options already set in my kernel config file, ... Next, I recompile the kernel, and install it. ... 4.11-p10 server (IPFW2 was installed during the buildworld-installworld ...
      (freebsd-questions)
    • Re: address specified as 1.2.3.4/24{128,35-55,89} Is this Correct ????
      ... Do you use ipfw2? ... It's not default on FreeBSD 4.x systems. ... And maybe you should quote ... To unsubscribe, ...
      (FreeBSD-Security)
    • IPACCT
      ... Now I using FreeBSD 5.0 and ... IPFW2. ... How I enable IPACCT and how configure. ... Best regards ...
      (freebsd-questions)