lkml.org 
[lkml]   [1999]   [Dec]   [22]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
From
SubjectRe: questions about /proc/sys/net/ipv4/conf/ on 2.2
Date
Hello!

> I notice there is a "default" directory in there, as well as an "all" and
> one for each of your network interfaces. How does one know which is the
> "default" interface? Also, what does the default interface imply... iow,
> what changes would be inflicted by making a certain interface the default?

It is not an interface is "default". It is default set of parameters.
When new interface appears, it inherits parameters from this set.
That's all.

> Does setting an option in one of the interfaces' directories override a
> contradictory setting in the "all" directory? Or is it the other way
> around? The kernel docs mention that "Changes in the all subdirectory
> affect all interfaces, where changes in the other subdirectories affect
> only one interface" but it does not say which will take precedence.

The doc is not quite right. "all" do apply to all the interfaces.
But only "forwarding" variable is changed automatically on all
the devices, when "all" is changed.

All the others combine with device specific setting either
with "and" or with "or". For me rule is simple: good options are ored,
dangerous ones are anded 8). For exact rules see include/linux/inetdevice.h

The exception is "accept_redirects": it is anded for router (dangerous)
and ored for host (safe one).


> Would settings (such as accept_source_route, etc.) in this dir override
> kernel firewall rules or will the rules still block source routed packets
> if so configured? (Seems to me that the latter would be true.)

These options never even intersect with any firewall rules.
If conf/* options order to block, it will block.


> Also, in one of the LDP firewall How-Tos, I saw it noted that kernels
> >=2.1 would auto-reject packets coming from 127.* if they were incoming on
> any iface besides lo. However, I was able to spoof packets from 127.0.0.1
> into my ppp0 interface from a remote box and they were not automatically
> rejected (until I blocked them with ipchains). Is there something I did
> wrong or was this feature removed somewhere between 2.1 and 2.2?

It is absolutely impossible. What did you drink? 8)8)8)

It is joke. I think you saw them in input chain, because
it is tested before packet enters IP stack. IP stack do not
eat such a crap yet 8).


> Lastly, each of these dirs has a "forwarding" option in it. Should this
> override the setting in /proc/sys/net/ipv4/ip_forward?

They are one thing really. Just two names for one variable.

Alexey

-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.rutgers.edu
Please read the FAQ at http://www.tux.org/lkml/

\
 
 \ /
  Last update: 2005-03-22 13:55    [W:0.265 / U:1.092 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site