OSEC

Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email hr@neohapsis.com
 
Subject: Re: Problems with natd and simple firewall
From: Bill Fumerola (billfchimesnet.com)
Date: Tue Jul 25 2000 - 18:39:41 CDT

On Tue, Jul 25, 2000 at 02:28:09PM -0700, Rodney W. Grimes wrote:

> And I'll cast my vote against -antispoof for the following reasons.

Ditto.

> a) The non-problem it attempts to solve can be handled by a correct
> ipfw rule set.
>
> b) These are RFC1918 addresses and have little to nothing to do with
> spoofing. RFC1918 != spoof. Spoofing occurs when using ligitmate
> globally routed IP addresses, usually the attack targets address as a
> source address in a packet. The flag should be -antirfc1918.
>
> c) It also totally ignores the fact that the problematic IP addresses
> are much more than RFC1918 and include the following:
> 0.0.0.0/8, 127.0.0.0/8, 192.0.2.0/24, 169.254.0.0/16, 240.0.0.0/4
> that need to be dealt with properly and carefully at both interfaces
> in a firewall.

Speaking has someone who operates a packet magnet, spoofed addresses come
from _EVERYWHERE_ and there isn't a whole lot you can do to stop that
(short of checking the route back before allowing the packet, which is more
costly etc etc, cisco has something that does this). 

-- 
Bill Fumerola - Network Architect, BOFH / Chimes, Inc.
                billfchimesnet.com / billfFreeBSD.org

To Unsubscribe: send mail to majordomoFreeBSD.org
with "unsubscribe freebsd-security" in the body of the message