From owner-freebsd-questions Mon Sep 25 3:29: 6 2000 Delivered-To: freebsd-questions@freebsd.org Received: from srcso.globis.ru (globis.ru [212.248.80.7]) by hub.freebsd.org (Postfix) with ESMTP id 1683D37B422 for ; Mon, 25 Sep 2000 03:28:53 -0700 (PDT) Received: from raduga.dyndns.org (raduga.sochi.net [212.248.82.76]) by srcso.globis.ru (8.9.3/8.9.3) with ESMTP id NAA10500 for ; Mon, 25 Sep 2000 13:43:30 +0400 (MSD) (envelope-from igor@raduga.dyndns.org) Received: (from igor@localhost) by raduga.dyndns.org (8.10.0/8.10.0) id e8P9PHL20243 for freebsd-questions@FreeBSD.ORG; Mon, 25 Sep 2000 13:25:17 +0400 Date: Mon, 25 Sep 2000 13:25:16 +0400 From: Igor Roboul To: freebsd-questions@FreeBSD.ORG Subject: Re: Question.. Message-ID: <20000925132516.A20206@linux.rainbow> Reply-To: igorr@crosswinds.net Mail-Followup-To: freebsd-questions@FreeBSD.ORG References: <39CF0A63.27989017@home.com> <20000925015357.T9141@fw.wintelcom.net> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii X-Mailer: Mutt 1.0pre4i In-Reply-To: <20000925015357.T9141@fw.wintelcom.net>; from bright@wintelcom.net on Mon, Sep 25, 2000 at 01:53:57AM -0700 X-Operating-System: Linux linux.rainbow 2.2.14-plus-SMP X-Best-Window-Manager: Window Maker (www.windowmaker.org) Sender: owner-freebsd-questions@FreeBSD.ORG Precedence: bulk X-Loop: FreeBSD.ORG On Mon, Sep 25, 2000 at 01:53:57AM -0700, Alfred Perlstein wrote: > > You can't do that. In Linux case. Spoofed packets _need_ to enter machine so we can decline they. This is infor from Linux /usr/src/linux/Documentation/proc.txt: -------------------------- In the directory /proc/sys/net/ipv4/conf you'll find one subdirectory [snip] rp_filter Integer value deciding if source validation should be made. 1 means yes, 0 means no. Disabled by default, but local/broadcast address spoofing is always on. If you set this to 1 on a router that is the only connection for a network to the net , it evidently prevents spoofing attacks against your internal networks (external addresses can still be spoofed), without the need for additional firewall rules. --------------------------- -- Igor Roboul, Unix System Administrator & Programmer @ sanatorium "Raduga", Sochi, Russia http://www.brainbench.com/transcript.jsp?pid=304744 To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-questions" in the body of the message