From owner-freebsd-security  Thu Jan 23 10:42:10 2003
Delivered-To: freebsd-security@freebsd.org
Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125])
	by hub.freebsd.org (Postfix) with ESMTP id 8398737B401
	for <freebsd-security@FreeBSD.ORG>; Thu, 23 Jan 2003 10:42:08 -0800 (PST)
Received: from cactus.fi.uba.ar (cactus.fi.uba.ar [157.92.49.108])
	by mx1.FreeBSD.org (Postfix) with ESMTP id 4475C43E4A
	for <freebsd-security@FreeBSD.ORG>; Thu, 23 Jan 2003 10:42:07 -0800 (PST)
	(envelope-from fgleiser@cactus.fi.uba.ar)
Received: from cactus.fi.uba.ar (cactus.fi.uba.ar [157.92.49.108])
	by cactus.fi.uba.ar (8.12.3/8.12.3) with ESMTP id h0NId4ui025500;
	Thu, 23 Jan 2003 15:39:04 -0300 (ART)
	(envelope-from fgleiser@cactus.fi.uba.ar)
Date: Thu, 23 Jan 2003 15:39:04 -0300 (ART)
From: Fernando Gleiser <fgleiser@cactus.fi.uba.ar>
To: Dung Patrick <dkt@digitalme.com>
Cc: freebsd-security@FreeBSD.ORG
Subject: Re: Egress filtering
In-Reply-To: <1043335229.ca145a00dkt@digitalme.com>
Message-ID: <20030123153522.T4134-100000@cactus.fi.uba.ar>
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
X-Spam-Status: No, hits=-102.3 required=5.0
	tests=IN_REP_TO,DOUBLE_CAPSWORD,USER_IN_WHITELIST
	version=2.31
Sender: owner-freebsd-security@FreeBSD.ORG
Precedence: bulk
List-ID: <freebsd-security.FreeBSD.ORG>
List-Archive: <http://docs.freebsd.org/mail/> (Web Archive)
List-Help: <mailto:majordomo@FreeBSD.ORG?subject=help> (List Instructions)
List-Subscribe: <mailto:majordomo@FreeBSD.ORG?subject=subscribe%20freebsd-security>
List-Unsubscribe: <mailto:majordomo@FreeBSD.ORG?subject=unsubscribe%20freebsd-security>
X-Loop: FreeBSD.org

On Thu, 23 Jan 2003, Dung Patrick wrote:

> Hello,
>
> For the egress filtering, I would only allow my firewall to send out
> packet only with the public IP of the firewall address. Not only dropping
> outgoing source address with RFC1918 address.
>
> I have a rule like this in ipfilter:
>
> block out log on dc0 from !fw_public_IP to any
>
> But I see this in my log:
> 192.168.0.1 (private LAN) -> a.b.c.d (an web server in Internet )
> The ipfilter has drop/log packet before NAT. If it is after NAT, my source
> address will be fw_public_IP and the above block rule will be skipped.

Ipfilter always sees the real IP. That is it does filtering before NAT
for outgoing packets and NAT before filtering for incoming ones.


			Fer

>
> Any suggestion?
>
> Regards,
> Patrick
>
>
> To Unsubscribe: send mail to majordomo@FreeBSD.org
> with "unsubscribe freebsd-security" in the body of the message
>


To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-security" in the body of the message