From owner-freebsd-security  Thu Apr  4 15:19: 6 2002
Delivered-To: freebsd-security@freebsd.org
Received: from elvis.mu.org (elvis.mu.org [192.203.228.196])
	by hub.freebsd.org (Postfix) with ESMTP id AED5A37B417
	for <freebsd-security@FreeBSD.ORG>; Thu,  4 Apr 2002 15:19:01 -0800 (PST)
Received: by elvis.mu.org (Postfix, from userid 1098)
	id 75E47AE0C7; Thu,  4 Apr 2002 15:19:01 -0800 (PST)
Date: Thu, 4 Apr 2002 15:19:01 -0800
From: Bill Fumerola <billf@mu.org>
To: FreeBSD <freebsd@icablenet.com.br>
Cc: freebsd-security@FreeBSD.ORG
Subject: Re: IpFilter / IpFireWall
Message-ID: <20020404231901.GM1135@elvis.mu.org>
References: <a8ii7f+9qbc@eGroups.com> <001f01c1dc2c$23f86e40$0225d7c8@broilo>
Mime-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <001f01c1dc2c$23f86e40$0225d7c8@broilo>
User-Agent: Mutt/1.3.27i
X-Operating-System: FreeBSD 4.5-MUORG-20020317 i386
Sender: owner-freebsd-security@FreeBSD.ORG
Precedence: bulk
List-ID: <freebsd-security.FreeBSD.ORG>
List-Archive: <http://docs.freebsd.org/mail/> (Web Archive)
List-Help: <mailto:majordomo@FreeBSD.ORG?subject=help> (List Instructions)
List-Subscribe: <mailto:majordomo@FreeBSD.ORG?subject=subscribe%20freebsd-security>
List-Unsubscribe: <mailto:majordomo@FreeBSD.ORG?subject=unsubscribe%20freebsd-security>
X-Loop: FreeBSD.org

On Thu, Apr 04, 2002 at 07:57:47PM -0300, FreeBSD wrote:
> to use ipfw&ipf use this in your kernel! :)
> 
> options         IPFIREWALL
> options         IPDIVERT

IPDIVERT isn't required unless you're using divert sockets (natd, mostly).

> options         IPFIREWALL_FORWARD

IPFIREWALL_FORWARD isn't required unless you're using 'ipfw fwd'.

> options         IPFIREWALL_VERBOSE
> options         IPFIREWALL_VERBOSE_LIMIT=100
> options         IPFIREWALL_DEFAULT_TO_ACCEPT
> options         IPFILTER
> options         IPFILTER_LOG

> options         TCPDEBUG

TCPDEBUG has nothing to do with ipfw or ipfilter and probably isn't even
that great of an idea on production systems.

> options         TCP_DROP_SYNFIN
> options         ICMP_BANDLIM

these also have nothing to do with ipfw or ipfilter.

> options         DUMMYNET

this is only required if you're using dummynet (rate limiting).

> options         IPSTEALTH

this has nothing to do with ipfw or ipfilter.


bad advice is actually worse then no advice at all...

-- 
- bill fumerola / fumerola@yahoo-inc.com / billf@FreeBSD.org / billf@mu.org
- my anger management counselor can beat up your self-affirmation therapist



To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-security" in the body of the message