Date: Wed, 28 Nov 2001 21:45:41 -0800 From: "Crist J. Clark" <cristjc@earthlink.net> To: klik <klik@unstable.org> Cc: Danny <eyezonme@gmx.net>, freebsd-security@FreeBSD.ORG Subject: Re: Ipfw + bpf interaction Message-ID: <20011128214541.J3985@blossom.cjclark.org> In-Reply-To: <Pine.LNX.4.33.0111281329250.23570-100000@ezri.unstable.org>; from klik@unstable.org on Wed, Nov 28, 2001 at 01:30:56PM -0500 References: <000e01c17834$5cf1d670$020144c0@danny> <Pine.LNX.4.33.0111281329250.23570-100000@ezri.unstable.org>
next in thread | previous in thread | raw e-mail | index | archive | help
On Wed, Nov 28, 2001 at 01:30:56PM -0500, klik wrote:
> Put those deny statments before your divert rule
It shouldn't make a difference unless the incoming HTTP connections
are being redirected.
> On Wed, 28 Nov 2001, Danny wrote:
>
> > Date: Wed, 28 Nov 2001 12:44:36 -0500
> > From: Danny <eyezonme@gmx.net>
> > To: freebsd-security@freebsd.org
> > Subject: Ipfw + bpf interaction
> >
> >
> > I've been experimenting with ipfw to horde off the hundreds of attempted
> > http requests per day (primarily all from @home customers) which I
> > suspect to be part of some lingering worm/ddos. My question is if a
> > connection attempt will still be recorded by clog(8) if the source IP is
> > blocked by ipfw?
There is nothing wrong. The bpf(4) device sees packets before they are
processed and blocked by ipfw(8).
[snip]
> > The rule seems to be added to ipfw's rule set, which for my box is as
> > follows:
> >
> > 00050 1915738 1315695882 divert 8668 ip from any to any via ep1
> > 00100 3360 1384342 allow ip from any to any via lo0
> > 00200 0 0 deny ip from any to 127.0.0.0/8
> > 00300 0 0 deny ip from 127.0.0.0/8 to any
> > 00400 1596 65772 deny log logamount 500 ip from
> > another.bad.host to my.ip.address
> > 00500 0 0 deny log logamount 500 ip from
> > 67.161.0.0/16 to my.ip.address
> > 65535 3795144 2623014796 allow ip from any to any
However, if you are seeing these in the clog(8)s, you should also be
seeing them later blocked.
--
Crist J. Clark | cjclark@alum.mit.edu
| cjclark@jhu.edu
http://people.freebsd.org/~cjc/ | cjc@freebsd.org
To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-security" in the body of the message
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20011128214541.J3985>