From owner-freebsd-security Tue Aug 21 3:57:53 2001 Delivered-To: freebsd-security@freebsd.org Received: from ringworld.nanolink.com (dialmess.nanolink.com [217.75.135.246]) by hub.freebsd.org (Postfix) with SMTP id 44CC437B407 for ; Tue, 21 Aug 2001 03:57:46 -0700 (PDT) (envelope-from roam@ringlet.net) Received: (qmail 10500 invoked by uid 1000); 21 Aug 2001 10:56:23 -0000 Date: Tue, 21 Aug 2001 13:56:23 +0300 From: Peter Pentchev To: Bart Matthaei Cc: freebsd-security@freebsd.org Subject: Re: IPfw and DHCP Message-ID: <20010821135623.E7824@ringworld.oblivion.bg> Mail-Followup-To: Bart Matthaei , freebsd-security@freebsd.org References: <20010821124202.B84400@heresy.xs4nobody.nl> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline User-Agent: Mutt/1.2.5i In-Reply-To: <20010821124202.B84400@heresy.xs4nobody.nl>; from bart@xs4nobody.nl on Tue, Aug 21, 2001 at 12:42:03PM +0200 Sender: owner-freebsd-security@FreeBSD.ORG Precedence: bulk List-ID: List-Archive: (Web Archive) List-Help: (List Instructions) List-Subscribe: List-Unsubscribe: X-Loop: FreeBSD.org On Tue, Aug 21, 2001 at 12:42:03PM +0200, Bart Matthaei wrote: > Run dhclient before you load the firewall rules.. > > and use recv and via instead of ip adresses :) recv and via do not provide the security that an IP address provides. In particular, both 'recv' and 'via ' fail to protect against the following case: NIC 1 xl0 192.168.0.13 RFC1918 LAN NIC 2 xl1 128.128.128.128 public ipfw add allow any recv via xl1 This would let a packet with a destination address of 192.168.0.13 via your public interface. And believe me, the chances of such a packet appearing on the wire are not so slim these days :) A better solution would be to have dhclient run *after* the initial firewall setup (after the firewall rulesets are flushed), and define hooks for obtaining/renewing/expiring a lease, which add or remove firewall rules as appropriate. Unfortunately, I've never done DHCP hooks, and I have no idea on how exactly to provide those. (Maybe it's as simple as putting something similar to /sbin/dhclient-script into /etc/dhclient-exit-hooks?) G'luck, Peter -- Nostalgia ain't what it used to be. > On Tue, Aug 21, 2001 at 11:53:43AM +0200, Lasse Osterberg wrote: > > Hi All, > > > > Is there anyway at system startup and/or via a cron job to pass my DHCP > > ipaddress from my external interface to rc.firewall? > > So my firewall rules still work if my external DHCP lease gets a new > > ipaddress. To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-security" in the body of the message