[lkml]   [1996]   [May]   [16]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
Messages in this thread
SubjectRe: Firewalling in recent kernels
On Wed, 15 May 1996, Thomas Omerzu wrote:
> This basically works as expected, except for two problems:
> - When a disallowed connection is going to be established, the
> gateway rejects it with "ICMP host unreachable".
> I'm somewhat unsure whether this is a good idea, since actually
> the destination host might be reachable through other ports.
> (And I wouldn't be astonished if some OS takes such an ICMP as
> a reason to drop all already established connections to that
> destination.)
> Wouldn't it be better to just refuse that connection?

Hmm, shouldn't we be useing one of the higher (uncommented, 6-12) numbers
in the codes for UNREACH section in <linux/icmp.h> ?

> - If the target of a rejected connection is the gateway host,
> the connection is not rejected, but blocked (i.e. no ICMP is
> sent), just as if a "ipfwadm -O -a deny ..." had been set.
> This is a bug, isn't it?

Hmm, seem's to me this is the same as the last one (tho proberbly the
whole net rather than just the host).

> --
> MfG
> Thomas Omerzu
PGP key pass phrase forgotten, \ Overload -- core meltdown sequence
again :( | initiated.
/ This space is intentionally left
| blank, apart from this text ;-)

 \ /
  Last update: 2005-03-22 13:37    [W:0.039 / U:2.708 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site