RE: IPChains leak for UDP!?

From: Peter Mueller (pmueller@sidestep.com)
Date: 10/31/01 

Message-ID: <37328159548B4242A34141B1A69CDB730323A7@exchange.sidestep.com>
From: Peter Mueller <pmueller@sidestep.com>
To: "'Sanjeev B.S.'" <sanjeev@mbu.iisc.ernet.in>, focus-linux@securityfocus.com
Subject: RE: IPChains leak for UDP!?
Date: Wed, 31 Oct 2001 13:38:32 -0800

|I configured ipchains in the following way in the order given below.
|1) Default ACCEPT for input and output and DENY for forward.

default policy should be deny, then add your rules, then add a 'logger'
catch-deny statement at the bottom.

I believe you are under the mistaken assumption that you need to have
default policy ACCEPT then DENY it later in a -A rule, right? < I think I
did the same thing a while back :P >

(( what UDP might you require? on my boxes the only thing UDP is useful for
is NTP & return packets for my gateway box.. too bad you can't do a ! -y
with udp :( ))

Peter

Relevant Pages

  • Re: SMP and networking under FreeBSD 5.3
    ... $ipfw_cmd add deny all from 127.0.0.1 to 127.0.0.1 ... $ipfw_cmd add allow udp from x.x.x.x y to x.x.255.255 y via ... $INTERNET_IFACE keep-state ... $ipfw_cmd add allow icmp from $FULL_LAN to any out xmit ...
    (freebsd-questions)
  • Re: Cisco 827 - logging on, but nothing being logged
    ... Did you notice the location of the 'deny ip any any' ACL Statement? ... When I send UDP & TCP Packets using a tool to send UDP ... TCP & UDP permit lists. ...
    (comp.dcom.sys.cisco)
  • Re: Cisco 827 - logging on, but nothing being logged
    ... Your deny ip any is NOT at the end og the ACL ... ... send udp & tcp traffic to this router, ... at the end of the access-list so I would expect to see the permit ... tcp traffic being logged on the 1720. ...
    (comp.dcom.sys.cisco)
  • Re: ipchains help
    ... you specifically block ONLY tcp connection attempts. ... You cannot block all UDP if you want DNS to ... forward DENY ...
    (Security-Basics)
  • Re: Please help on Tiny Firewall message
    ... I recently start using Tiny Personal and I got repeat outbound ... >> tell me if I should deny it or let it through? ... Port 137 for both TCP and UDP is assigned to the NETBIOS name ...
    (comp.security.firewalls)