From owner-cvs-all Wed Mar 21 13:20: 0 2001 Delivered-To: cvs-all@freebsd.org Received: from mailgate.originative.co.uk (mailgate.originative.co.uk [62.232.68.68]) by hub.freebsd.org (Postfix) with ESMTP id 4B9B737B71E; Wed, 21 Mar 2001 13:19:52 -0800 (PST) (envelope-from paul@freebsd-services.co.uk) Received: from freebsd-services.co.uk (lobster.originative.co.uk [62.232.68.81]) by mailgate.originative.co.uk (Postfix) with ESMTP id CACDC1D14A; Wed, 21 Mar 2001 21:09:43 +0000 (GMT) Message-ID: <3AB918CB.33EC9A98@freebsd-services.co.uk> Date: Wed, 21 Mar 2001 21:10:35 +0000 From: Paul Richards X-Mailer: Mozilla 4.76 [en] (X11; U; Linux 2.2.12 i386) X-Accept-Language: en MIME-Version: 1.0 To: Bill Fumerola Cc: Paul Richards , cvs-committers@FreeBSD.org, cvs-all@FreeBSD.org Subject: Re: cvs commit: src/sys/netinet ip_fw.c References: <200103210819.f2L8JWm19214@freefall.freebsd.org> <20010321150244.F2567@elvis.mu.org> Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: 7bit Sender: owner-cvs-all@FreeBSD.ORG Precedence: bulk X-Loop: FreeBSD.ORG Bill Fumerola wrote: > > On Wed, Mar 21, 2001 at 12:19:32AM -0800, Paul Richards wrote: > > > Modified files: > > sys/netinet ip_fw.c > > Log: > > Only flush rules that have a rule number above that set by a new > > sysctl, net.inet.ip.fw.permanent_rules. > > > > This allows you to install rules that are persistent across flushes, > > which is very useful if you want a default set of rules that > > maintains your access to remote machines while you're reconfiguring > > the other rules. > > > > Reviewed by: Mark Murray > > Ugh. > > If you're configuring remote machines with a default deny rule instead > of explcitly adding a deny rule you might want to reconsider. Explain? Configuring *any* server without a default deny rule is more foolhardy because there's a window of opportunity for a hacker before the rules are applied. Paul. To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe cvs-all" in the body of the message