Date: Tue, 17 Dec 2002 13:27:41 -1000 From: Clifton Royston <cliftonr@lava.net> To: Craig Boston <craig@meoqu.gank.org> Cc: stable@freebsd.org Subject: Re: ipfilter / ipnat quandry Message-ID: <20021217132741.D26691@lava.net> In-Reply-To: <1040165976.4062.8.camel@owen1492.it.oot>; from craig@meoqu.gank.org on Tue, Dec 17, 2002 at 04:59:37PM -0600 References: <1040165976.4062.8.camel@owen1492.it.oot>
next in thread | previous in thread | raw e-mail | index | archive | help
On Tue, Dec 17, 2002 at 04:59:37PM -0600, Craig Boston wrote:
> On Tue, 2002-12-17 at 13:02, Clifton Royston wrote:
> > ipf does have the ability to more correctly simulate a closed port.
> > I did a similar exercise on my personal OpenBSD firewall box earlier
> > this year; I won't go through your whole ruleset, but basically for
> > every TCP port you block, you need to add a return-rst, and for every
> > UDP port you block, you need to add return-icmp(port-unr). This
> > provides a pretty good simulation of a host running no services, if
> > that's what you want to look like.
>
> Does ipfw or ipf have the ability to return a SYN/ACK packet for each
> incoming SYN, and return an appropriate ACK any incoming ACK packets?
That's a very amusing idea, especially when applied to non-assigned
IP addresses behind a firewall. I don't know and haven't checked the
docs.
-- Clifton
--
Clifton Royston -- LavaNet Systems Architect -- cliftonr@lava.net
"If you ride fast enough, the Specialist can't catch you."
"What's the Specialist?" Samantha says.
"The Specialist wears a hat," says the babysitter. "The hat makes noises."
She doesn't say anything else.
Kelly Link, _The Specialist's Hat_
To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-stable" in the body of the message
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20021217132741.D26691>