Date: Sun, 04 Feb 2007 12:25:05 +0100 From: Erik Norgaard <norgaard@locolomo.org> To: Noah <admin2@enabled.com> Cc: freebsd-questions@freebsd.org Subject: Re: temporary IP addition to firewall rules Message-ID: <45C5C291.30608@locolomo.org> In-Reply-To: <45C53C7A.30805@enabled.com> References: <45C53C7A.30805@enabled.com>
next in thread | previous in thread | raw e-mail | index | archive | help
[-- Attachment #1 --] Noah wrote: > Does anybody have a recommendation for a program out there that would > allow somebody to enter an account and password on my website, their IP > address is cached, and the cached IP address is added temporarily to the > firewall ruleset to be allowed. I am not aware of anything that works like that, pfauth may do the job for you, but not using a web site. Generally the problem is that web pages are stateless, so your firewall won't know when to remove the ip again. You can hack up a solution that does sort of the same: - let your web page manage accounts, the web server can get ip of the client registering and hence also the corresponding mac. - tell your dhcp server not to expire ip delegations, or make host entries with the registered ip/mac, but that requires the dhcp server to be restarted at every new client. - make a static entry in your arp table to prevent others from taking over the ip later. People will only need to authenticate first time. You can decide to expire their accounts and revoke access after a given time with a cron-job if you like. Alternatively, require people to connect with IPSec tunnel and allow only tunneled traffic to be routed. When they register a set of keys are generated for use with that client only. This is really the ideal as you can for example leave an AP open, yet have traffic encrypted. Cheers, Erik -- Ph: +34.666334818 web: http://www.locolomo.org [-- Attachment #2 --] 0 *H 01 0 + 0 *H 0p0XET+0 *H 011 0 UDK1 0 U TDC10U TDC OCES CA0 061115083154Z 081115090154Z0u1 0 UDK1)0'U Ingen organisatorisk tilknytning1;0U Erik Nrgaard0#U PID:9802-2002-2-54436976931500 *H 0 WR&5ʄ8 #S^fOパBrIsPBc! >r&8hl3?\.UGB\E 3Q!1MrwP*02\|\&s{b'`1&1 00U 0+U $0"20061115083154Z20081115090154Z07U .0*0& *P)00/+#http://www.certifikat.dk/repository0+00 TDC0For anvendelse af certifikatet glder OCES vilkr, CPS og OCES CP, der kan hentes fra www.certifikat.dk/repository. Bemrk, at TDC efter vilkrene har et begrnset ansvar ift. professionelle parter.0A+50301+0%http://ocsp.certifikat.dk/ocsp/status0 U 0norgaard@locolomo.org0U }0{0KIGE0C1 0 UDK1 0 U TDC10U TDC OCES CA10UCRL15570,*(&http://crl.oces.certifikat.dk/oces.crl0 U #0`Vd~'g PKs;0 U ~kG 'f+Q{m&0 U 0 0 *H}A 0 V7.10 *H OJ'|)%Ҋi`1 ^nE jJwKӼB 65V SǶw`y$L =YXʷ/\E~,PW$AB\ 汎 ͙ 7%$ N-ށ"/Ww#ғkMA6S0dD~\w*z Pq`# 69;pS6 뛨3:9s_.'³Q$S0yAƶlqfLi0p0XET+0 *H 011 0 UDK1 0 U TDC10U TDC OCES CA0 061115083154Z 081115090154Z0u1 0 UDK1)0'U Ingen organisatorisk tilknytning1;0U Erik Nrgaard0#U PID:9802-2002-2-54436976931500 *H 0 WR&5ʄ8 #S^fOパBrIsPBc! >r&8hl3?\.UGB\E 3Q!1MrwP*02\|\&s{b'`1&1 00U 0+U $0"20061115083154Z20081115090154Z07U .0*0& *P)00/+#http://www.certifikat.dk/repository0+00 TDC0For anvendelse af certifikatet glder OCES vilkr, CPS og OCES CP, der kan hentes fra www.certifikat.dk/repository. Bemrk, at TDC efter vilkrene har et begrnset ansvar ift. professionelle parter.0A+50301+0%http://ocsp.certifikat.dk/ocsp/status0 U 0norgaard@locolomo.org0U }0{0KIGE0C1 0 UDK1 0 U TDC10U TDC OCES CA10UCRL15570,*(&http://crl.oces.certifikat.dk/oces.crl0 U #0`Vd~'g PKs;0 U ~kG 'f+Q{m&0 U 0 0 *H}A 0 V7.10 *H OJ'|)%Ҋi`1 ^nE jJwKӼB 65V SǶw`y$L =YXʷ/\E~,PW$AB\ 汎 ͙ 7%$ N-ށ"/Ww#ғkMA6S0dD~\w*z Pq`# 69;pS6 뛨3:9s_.'³Q$S0yAƶlqfLi1*0&09011 0 UDK1 0 U TDC10U TDC OCES CAET+0 + G0 *H 1 *H 0 *H 1 070204112505Z0# *H 1jxdn/h4j`c0H +71;09011 0 UDK1 0 U TDC10U TDC OCES CAET+0J *H 1;9011 0 UDK1 0 U TDC10U TDC OCES CAET+0R *H 1E0C0 *H 0*H 0 *H @0+0 *H (0 *H w%lA\d+5j J4n* ߊS7?;Ma x! YwtǩI.̓-Jl4Vhfpbdљ[X1e0%Ur+Wx۱
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?45C5C291.30608>