Date: Fri, 24 Jan 2003 10:23:56 +0800 From: Dung Patrick <dkt@digitalme.com> To: fgleiser@cactus.fi.uba.ar, Cc: freebsd-security@FreeBSD.ORG, Subject: Re: Re: Egress filtering Message-ID: <1043375036.a20e0240dkt@digitalme.com>
next in thread | raw e-mail | index | archive | help
Hi, It seems that I get a quick fix with the help of ipfw. I add this rule to ipfw: ipfw add deny ip from not a.b.c.d to any out xmit xl0 where a.b.c.d is my fw public IP and xl0 is the public interface Regards, Patrick -----Original Message----- From: Fernando Gleiser <fgleiser@cactus.fi.uba.ar> To: Dung Patrick <dkt@digitalme.com> Date: Thu, 23 Jan 2003 15:39:04 -0300 (ART) Subject: Re: Egress filtering On Thu, 23 Jan 2003, Dung Patrick wrote: > Hello, > > For the egress filtering, I would only allow my firewall to send out > packet only with the public IP of the firewall address. Not only dropping > outgoing source address with RFC1918 address. > > I have a rule like this in ipfilter: > > block out log on dc0 from !fw_public_IP to any > > But I see this in my log: > 192.168.0.1 (private LAN) -> a.b.c.d (an web server in Internet ) > The ipfilter has drop/log packet before NAT. If it is after NAT, my sourc= e > address will be fw_public_IP and the above block rule will be skipped. Ipfilter always sees the real IP. That is it does filtering before NAT for outgoing packets and NAT before filtering for incoming ones. =09=09=09Fer > > Any suggestion? > > Regards, > Patrick > > > To Unsubscribe: send mail to majordomo@FreeBSD.org > with "unsubscribe freebsd-security" in the body of the message > To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-security" in the body of the message
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?1043375036.a20e0240dkt>