Date: Sun, 15 Feb 2004 16:11:33 +0000 From: erschulz@comcast.net To: Flemming Jacobsen <fj@batmule.dk> Cc: freebsd-security@freebsd.org Subject: Re: Localhost traffic and ipfw rules Message-ID: <021520041611.22703.f3e@comcast.net>
next in thread | raw e-mail | index | archive | help
On Sun, 15 Feb 2004, Flemming Jacobsen wrote:
> You probably want this as your first 3 rules:
> allow ip from any to any via lo0
> deny ip from any to 127.0.0.0/8
> deny ip from 127.0.0.0/8 to any
>
> Some say that the TCP stack already takes care of this, but I
> like these rules in my set - just to be 100% sure.
>
Sorry about the long lines. I hope this is one better.
Well, let me see if I can clarify what I am seeing. My rules are
similar but, the counters are not incrementing. That's
when I started adding the other rules just to see if the counters
would increment. The second rule below is a dead-on match for
the packets I captured with tcpdump. Still, the counters do
not increment.
0 0 deny ip from any to 127.0.0.0/8 in recv dc0
0 0 deny tcp from 127.0.0.1 to x.x.x.x tcpflags ack,rst
0 0 deny ip from 127.0.0.0/8 to x.x.x.x
As you can see, none of these have incremented. And, this has
been the case every time even though snort identified the traffic
and I captured it with tcpdump. The counters were still zeros.
The traffic is not present on lo0 or my internal interface. It
is only present on my external interface.
I'm not so much concerned about the traffic as I am with
the failure of the counters to increment.
Thx,
Richard
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?021520041611.22703.f3e>