Date: Fri, 31 Mar 2000 15:39:08 +0100 From: Brian Somers <brian@Awfulhak.org> To: mm@i.cz Cc: freebsd-net@FreeBSD.ORG, brian@hak.lan.Awfulhak.org Subject: Re: Security of NAT "firewall" vs. packet filtering firewall. Message-ID: <200003311439.PAA03288@hak.lan.Awfulhak.org> In-Reply-To: Message from Martin Machacek <mm@i.cz> of "Fri, 31 Mar 2000 16:20:38 %2B0200." <XFMail.000331162038.mm@i.cz>
next in thread | previous in thread | raw e-mail | index | archive | help
>
> On 31-Mar-00 Brian Somers wrote:
> > In fact, there's a bug in libalias. Packets destined to anything
> > that's not redirected (with PacketAliasRedirectAddr() or implicitly)
> > should be redirected to the alias address according to the
> > documentation.
> >
> > This is now reality (as of about a minute ago).
>
> There is possibly another bug in natd/libalias. Incoming ICMP packets are
> being translated and forwarded if there is some "redirect address" configured
> even if "deny-incoming" is specified. TCP/UDP packets are denied correctly. I
> haven't had enough time to inspect this possible problem more thoroughly so I
> haven't produced any PR yet. Maybe somebody else has more time ... :-)
Yes, I think I noticed this when I was in there a little while ago.
The DENY_INCOMING flag is only checked for incoming tcp/udp
connections.
> Martin
>
> ---
> [PGP KeyID F3F409C4]
--
Brian <brian@Awfulhak.org> <brian@[uk.]FreeBSD.org>
<http://www.Awfulhak.org>; <brian@[uk.]OpenBSD.org>
Don't _EVER_ lose your sense of humour !
To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-net" in the body of the message
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?200003311439.PAA03288>