From owner-freebsd-security Fri Jun 11 14:51:49 1999 Delivered-To: freebsd-security@freebsd.org Received: from relay.ucb.crimea.ua (relay.ucb.crimea.ua [212.110.138.1]) by hub.freebsd.org (Postfix) with ESMTP id A8DFB14D55 for ; Fri, 11 Jun 1999 14:50:19 -0700 (PDT) (envelope-from ru@ucb.crimea.ua) Received: (from ru@localhost) by relay.ucb.crimea.ua (8.9.3/8.9.3/UCB) id AAA30944; Sat, 12 Jun 1999 00:46:33 +0300 (EEST) (envelope-from ru) Date: Sat, 12 Jun 1999 00:46:33 +0300 From: Ruslan Ermilov To: Pete Fritchman Cc: "Jason L. Schwab" , ghandi@mindless.com, freebsd-security@FreeBSD.ORG Subject: Re: firewalls Message-ID: <19990612004633.A29090@relay.ucb.crimea.ua> Mail-Followup-To: Pete Fritchman , "Jason L. Schwab" , ghandi@mindless.com, freebsd-security@FreeBSD.ORG References: Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii X-Mailer: Mutt 0.95.3i In-Reply-To: ; from Pete Fritchman on Fri, Jun 11, 1999 at 05:15:07PM -0400 X-Operating-System: FreeBSD 3.2-STABLE i386 Sender: owner-freebsd-security@FreeBSD.ORG Precedence: bulk X-Loop: FreeBSD.org On Fri, Jun 11, 1999 at 05:15:07PM -0400, Pete Fritchman wrote: > You probably just want to deny all icmp to your dialup. > > ipfw add deny icmp from any to any > > -------------------- > [ Pete Fritchman ] > [ Systems Engineer ] > [petef@netreach.net] > -------------------- > Don't do it!!! It will broke Path MTU discovery: http://www.worldgate.com/~marcs/mtu/ Instead, use ICMP_BANDLIM option: * Add ICMP_BANDLIM option and 'net.inet.icmp.icmplim' sysctl. If option * is specified in kernel config, icmplim defaults to 100 pps. Setting it * to 0 will disable the feature. This feature limits ICMP error responses * for packets sent to bad tcp or udp ports, which does a lot to help the * machine handle network D.O.S. attacks. * * The kernel will report packet rates that exceed the limit at a rate of * one kernel printf per second. There is one issue in regards to the * 'tail end' of an attack... the kernel will not output the last report * until some unrelated and valid icmp error packet is return at some * point after the attack is over. This is a minor reporting issue only. Cheers, -- Ruslan Ermilov Sysadmin and DBA of the ru@ucb.crimea.ua United Commercial Bank +380.652.247.647 Simferopol, Ukraine http://www.FreeBSD.org The Power To Serve http://www.oracle.com Enabling The Information Age To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-security" in the body of the message