From owner-freebsd-ipfw  Mon Jul 26 11:18:22 1999
Delivered-To: freebsd-ipfw@freebsd.org
Received: from aurora.sol.net (aurora.sol.net [206.55.65.76])
	by hub.freebsd.org (Postfix) with ESMTP
	id 0EB1B14FB3; Mon, 26 Jul 1999 11:18:10 -0700 (PDT)
	(envelope-from jgreco@aurora.sol.net)
Received: (from jgreco@localhost)
	by aurora.sol.net (8.9.2/8.9.2/SNNS-1.02) id NAA05470;
	Mon, 26 Jul 1999 13:16:57 -0500 (CDT)
From: Joe Greco <jgreco@ns.sol.net>
Message-Id: <199907261816.NAA05470@aurora.sol.net>
Subject: securelevel and ipfw zero
To: freebsd-hackers@freebsd.org
Date: Mon, 26 Jul 1999 13:16:57 -0500 (CDT)
Cc: freebsd-ipfw@freebsd.org
X-Mailer: ELM [version 2.4ME+ PL43 (25)]
MIME-Version: 1.0
Content-Type: text/plain; charset=US-ASCII
Content-Transfer-Encoding: 7bit
Sender: owner-freebsd-ipfw@FreeBSD.ORG
Precedence: bulk
X-Loop: FreeBSD.ORG

Hello,

So, I've a box that I have an ipfw ruleset on.  The firewall should not be
changeable during runtime, and the box runs at securelevel=3.

In order to prevent DoS disk-fill attacks, I also have specified
IPFW_VERBOSE_LIMIT.

Now, the problem is, in securelevel 3, you cannot zero a rule's counter,
so basically once you are up and running, you get to log IPFW_VERBOSE_LIMIT
events and then you lose logging (ideally I'd zero nonzero rules once every
N minutes).

Comments?

... Joe

-------------------------------------------------------------------------------
Joe Greco - Systems Administrator			      jgreco@ns.sol.net
Solaria Public Access UNIX - Milwaukee, WI			   414/342-4847


To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-ipfw" in the body of the message