OSEC

Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email hr@neohapsis.com
 
Subject: ipfw dynamic rules & tcp rst
From: Keith Ray (rayksugar-land.spc.slb.com)
Date: Mon Apr 03 2000 - 11:03:48 CDT

I have been using the new dynamic ipfw rules in 4.0. I wanted to make the
firewall react as though it didn't exist by returning TCP RSTs instead of
just dropping the connection. However, the following rules do not work:

00400 check-state
00500 reset tcp from any to {myip} established
00600 reset tcp from {myip} to any established
00700 allow tcp from any to {myip} 22 keep-state setup
00800 reset tcp from any to {myip} setup
65535 deny ip from any to any

When a connection comes in for a non-allowed port, rule 800 rejects the
connection. However, rule 600 prevents the TCP RST from being sent and the
connection is dropped. The following rules work however:

00300 allow tcp from {myip} to any
00400 check-state
00500 reset tcp from any to {myip} established
00600 allow tcp from any to {myip} 22 keep-state setup
00700 reset tcp from any to {myip} setup
65535 deny ip from any to any

This time the connection is rejected and rule 300 allows the RST to be
sent. Is there a better way of accomplishing this?

To Unsubscribe: send mail to majordomoFreeBSD.org
with "unsubscribe freebsd-security" in the body of the message