From owner-freebsd-security Tue Nov 14 18:43:23 2000 Delivered-To: freebsd-security@freebsd.org Received: from citusc17.usc.edu (citusc17.usc.edu [128.125.38.177]) by hub.freebsd.org (Postfix) with ESMTP id 0D14337B4C5 for ; Tue, 14 Nov 2000 18:43:21 -0800 (PST) Received: (from kris@localhost) by citusc17.usc.edu (8.11.1/8.11.1) id eAF2iEn03946; Tue, 14 Nov 2000 18:44:14 -0800 (PST) (envelope-from kris) Date: Tue, 14 Nov 2000 18:44:14 -0800 From: Kris Kennaway To: Brian Somers Cc: Nuno Teixeira , freebsd-security@FreeBSD.ORG Subject: Re: PPP NAT Gateway security Message-ID: <20001114184414.A3878@citusc17.usc.edu> References: <200011141850.eAEIoXY00540@hak.lan.Awfulhak.org> Mime-Version: 1.0 Content-Type: multipart/signed; micalg=pgp-md5; protocol="application/pgp-signature"; boundary="dDRMvlgZJXvWKvBx" Content-Disposition: inline User-Agent: Mutt/1.2.5i In-Reply-To: <200011141850.eAEIoXY00540@hak.lan.Awfulhak.org>; from brian@Awfulhak.org on Tue, Nov 14, 2000 at 06:50:33PM +0000 Sender: owner-freebsd-security@FreeBSD.ORG Precedence: bulk X-Loop: FreeBSD.org --dDRMvlgZJXvWKvBx Content-Type: text/plain; charset=us-ascii Content-Disposition: inline Content-Transfer-Encoding: quoted-printable On Tue, Nov 14, 2000 at 06:50:33PM +0000, Brian Somers wrote: > > Hello to all, > >=20 > > Recently I configured a FreeBSD box to act like a gateway for my NT > > workstation computers at my office have access to the Internet. I confi= gured > > it in this way: > >=20 > > ppp -background -nat MYISP > >=20 > > It works OK and I have access to a lot of Internet services. > >=20 > > My question is: do I need to configure this machine with firewall, so I= can > > protect my internal network from the outside net? > >=20 > > If I need so, please tell me a good place to start with firewalls for > > FreeBSD. >=20 > If you just want to deny incoming connections, you can ``nat=20 > deny_incoming yes'' and ``nat target MYADDR'' in your config=20 > (although *MAKE SURE* you've got a recent version of ppp - you can=20 > get it via http://www.Awfulhak.org/ppp.html - if in doubt, test it=20 > from the outside). The reason for this is described in security advisory 00:70 released today. Kris --dDRMvlgZJXvWKvBx Content-Type: application/pgp-signature Content-Disposition: inline -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.0.4 (FreeBSD) Comment: For info see http://www.gnupg.org iEYEARECAAYFAjoR+H0ACgkQWry0BWjoQKVkygCguo4umecmID1Kbgo9S1Fo8sbr flEAn2BLBdswAF4GZz0y49ES3l9ushGx =3Co1 -----END PGP SIGNATURE----- --dDRMvlgZJXvWKvBx-- To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-security" in the body of the message