From owner-freebsd-security  Fri Jun 29  8:35:17 2001
Delivered-To: freebsd-security@freebsd.org
Received: from veldy.net (w028.z064001117.msp-mn.dsl.cnc.net [64.1.117.28])
	by hub.freebsd.org (Postfix) with ESMTP id 88B7B37B403
	for <freebsd-security@freebsd.org>; Fri, 29 Jun 2001 08:35:13 -0700 (PDT)
	(envelope-from veldy@veldy.net)
Received: from HP2500B (localhost.veldy.net [127.0.0.1])
	by veldy.net (Postfix) with SMTP
	id 78574BAAC; Fri, 29 Jun 2001 10:35:10 -0500 (CDT)
Message-ID: <007801c100b0$e7527730$3028680a@tgt.com>
From: "Thomas T. Veldhouse" <veldy@veldy.net>
To: <George.Giles@mcmail.vanderbilt.edu>,
	<freebsd-security@freebsd.org>
References: <OFB8BDE232.323E44F5-ON86256A7A.005144B2@MC.VANDERBILT.EDU>
Subject: Re: What is ipfw telling me ?
Date: Fri, 29 Jun 2001 10:33:34 -0500
MIME-Version: 1.0
Content-Type: text/plain;
	charset="iso-8859-1"
Content-Transfer-Encoding: 7bit
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 5.50.4522.1200
X-MimeOLE: Produced By Microsoft MimeOLE V5.50.4522.1200
Sender: owner-freebsd-security@FreeBSD.ORG
Precedence: bulk
List-ID: <freebsd-security.FreeBSD.ORG>
List-Archive: <http://docs.freebsd.org/mail/> (Web Archive)
List-Help: <mailto:majordomo?subject=help> (List Instructions)
List-Subscribe: <mailto:majordomo?subject=subscribe%20freebsd-security>
List-Unsubscribe: <mailto:majordomo?subject=unsubscribe%20freebsd-security>
X-Loop: FreeBSD.org

You may want to limit such abuse via firewall rules.

# Stop RFC1918 nets on the outside interface
${fwcmd} add deny log all from any to 10.0.0.0/8 via ${oif}
${fwcmd} add deny log all from any to 172.16.0.0/12 via ${oif}
${fwcmd} add deny log all from any to 192.168.0.0/16 via ${oif}

# Stop draft-manning-dsua-03.txt (1 May 2000) nets (includes RESERVED-1,
# DHCP auto-configuration, NET-TEST, MULTICAST (class D), and class E)
# on the outside interface
${fwcmd} add deny log all from any to 0.0.0.0/8 via ${oif}
${fwcmd} add deny log all from any to 169.254.0.0/16 via ${oif}
${fwcmd} add deny log all from any to 192.0.2.0/24 via ${oif}
${fwcmd} add deny log all from any to 224.0.0.0/4 via ${oif}
${fwcmd} add deny log all from any to 240.0.0.0/4 via ${oif}

Tom Veldhouse
veldy@veldy.net

----- Original Message -----
From: <George.Giles@mcmail.vanderbilt.edu>
To: <freebsd-security@freebsd.org>
Sent: Friday, June 29, 2001 9:49 AM
Subject: What is ipfw telling me ?


> What is ipfw telling me ?
>
> The 216 host is attempting to break in, but how is it using port 80 on the
> other machine ?
>
>  ipfw: 2400 Deny TCP 216.239.46.20:21602 10.0.0.1:80 in via xl0
>
>
> To Unsubscribe: send mail to majordomo@FreeBSD.org
> with "unsubscribe freebsd-security" in the body of the message
>


To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-security" in the body of the message