From owner-freebsd-security Wed May 16 19:15:37 2001 Delivered-To: freebsd-security@freebsd.org Received: from mail.gmx.net (pop.gmx.net [194.221.183.20]) by hub.freebsd.org (Postfix) with SMTP id D9E8437B422 for ; Wed, 16 May 2001 19:15:34 -0700 (PDT) (envelope-from Gerhard.Sittig@gmx.net) Received: (qmail 4134 invoked by uid 0); 17 May 2001 02:15:29 -0000 Received: from pd9508861.dip.t-dialin.net (HELO speedy.gsinet) (217.80.136.97) by mail.gmx.net (mp030-rz3) with SMTP; 17 May 2001 02:15:29 -0000 Received: (from sittig@localhost) by speedy.gsinet (8.8.8/8.8.8) id VAA02047 for freebsd-security@freebsd.org; Wed, 16 May 2001 21:31:54 +0200 Date: Wed, 16 May 2001 21:31:54 +0200 From: Gerhard Sittig To: freebsd-security@freebsd.org Subject: Re: risks of ip-forwarding, without ipf/ipfw Message-ID: <20010516213154.A253@speedy.gsinet> Mail-Followup-To: freebsd-security@freebsd.org References: <20010516092959.A42898@beheer2.iae.nl> <20010516155615.40395.qmail@web14503.mail.yahoo.com> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii X-Mailer: Mutt 1.0i In-Reply-To: <20010516155615.40395.qmail@web14503.mail.yahoo.com>; from jedovaty@yahoo.com on Wed, May 16, 2001 at 08:56:15AM -0700 Organization: System Defenestrators Inc. Sender: owner-freebsd-security@FreeBSD.ORG Precedence: bulk X-Loop: FreeBSD.org On Wed, May 16, 2001 at 08:56 -0700, Jano Lukac wrote: > > If your IP changes (e.g. in a PPP or PPPoE link), do you have > to rerun ipf/ipfw/natd everytime? Or is freebsd smart about > this (unlike the unnamed arctic semi-counterpart which uses > ipchains/iptables)? Since the original question was heavily crossposted and went to the ipfilter list as well, I would like to point out that ipf(4) has to be "pushed" when interfaces should change their parameters. Read "man 8 ipf" and look at the -y switch. Plus look at the notion of specifying 0.0.0.0/32 addresses in the numerous examples shipped with ipfilter. Read "man 8 ppp" for where to hook things in (ppp.link{up,down}, I assume). virtually yours 82D1 9B9C 01DC 4FB4 D7B4 61BE 3F49 4F77 72DE DA76 Gerhard Sittig true | mail -s "get gpg key" Gerhard.Sittig@gmx.net -- If you don't understand or are scared by any of the above ask your parents or an adult to help you. To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-security" in the body of the message