From owner-freebsd-security  Thu Feb 22 11:14:19 2001
Delivered-To: freebsd-security@freebsd.org
Received: from ocis.ocis.net (ocis.ocis.net [209.52.173.1])
	by hub.freebsd.org (Postfix) with ESMTP id 453CC37B491
	for <freebsd-security@FreeBSD.ORG>; Thu, 22 Feb 2001 11:14:17 -0800 (PST)
	(envelope-from vdrifter@ocis.ocis.net)
Received: from localhost (vdrifter@localhost)
	by ocis.ocis.net (8.9.3/8.9.3) with ESMTP id LAA23637
	for <freebsd-security@FreeBSD.ORG>; Thu, 22 Feb 2001 11:14:16 -0800
Date: Thu, 22 Feb 2001 11:14:16 -0800 (PST)
From: John F Cuzzola <vdrifter@ocis.ocis.net>
To: freebsd-security@FreeBSD.ORG
Subject: Source routing
In-Reply-To: <Pine.BSF.4.33.0102221405430.72422-100000@ashburn.skiltech.com>
Message-ID: <Pine.LNX.4.21.0102221110400.22826-100000@ocis.ocis.net>
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
Sender: owner-freebsd-security@FreeBSD.ORG
Precedence: bulk
X-Loop: FreeBSD.org


Quick question. I have a FreeBSD NAT firewall and I want to make sure that
source routed packets are not honored. Does these sysctl settings do the
trick?

net.inet.ip.sourceroute: 0
net.inet.ip.accept_sourceroute: 0

or should I block them specifically with an ipfw + options rule? I want
both the FreeBSD firewall not to accept source route packets coming in or
going out.

Thanks in advance :)




To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-security" in the body of the message