KCLUG

1 participants
3235 discussions

RE: routing problem - fork on gateways
by Jeremy Fowler 08 Sep '05

08 Sep '05

> Ummm... no. Wrong on both accounts. > See Jeremy's post about source-routing for one method. > The firewall rules are never bypassed, that's why you need > rules to specifically allow "established" > connections. It is also why when writing your rules you want > to put those rules near the top so that established > connections don't have to run the entire gamut of the ruleset > to get an up/down vote on whether to accept. Now maybe some > firewalls resort the rules to get this behavior, but I > haven't seen this with any Linux software firewalls. Actually, I think what David is thinking about is the PREROUTING chain in the Linux Netfilter nat table. It only checks the first packet of each stream. <rant> Let's leave the "Ummm... No" out from now on. We're all learning here. I know it may sound stupid, but I find it rude. I went off on some guy last week about it - which I do feel bad about. I got a little out of line on one of my replies. Anyway, lets try and keep the respect for one another going here. Feel free to correct people, myself included, but lets try to keep it polite. </rant>

2 1

debian kernels
by Jack 08 Sep '05

08 Sep '05

Anyone ever successfully installed a debian kernel pacakge? I've been trying to compile a specific kernel module. So far no luck. So now I'm compiling and installing a kernel from sources. All because I want my scanner to work in debian. Funny it used to work out of the box in other distros, but in debian it is installing some funky wrong module. Granted it is a parallel port scanner. <rant> I have another scanner, which I just bought, but it won't work in Linux, so I need to build a M$ box so I can scan in my medium format negatives. Then I'll start working on finishing the experimental driver for the scanner. </rant> Thanks, Brian JD

4 5

RE: routing problem - fork on gateways
by Jeremy Fowler 07 Sep '05

07 Sep '05

> > what gets bypassed with established TCP connections is the firewall > > rules, as an optimization for reducing CPU load on firewall > machines. > > That's TCP connections, not routes. > > Routes must involve routers unless there is direct connection, (or > > faking of direct connection through VPN bridging or something like > > that) > > Nope, you can always source route a packet. Unless a host > along the path filters them. However, in the case there is > nothing to stop a application from source routing directly to > the firewall and bypassing the router. However, the > application would have to specifically do this as it is not > done automatically. One other way that I forgot about is ICMP type 5 Redirects. This is the more automatic approach and is probably what Brian (Jack?) is referring to. The router basically sends the host a message saying there is a better route and to update your routing table. However, the host must accept these packets, some disable redirects for obvious security reasons. RFC 792, page 13: The gateway sends a redirect message to a host in the following situation. A gateway, G1, receives an internet datagram from a host on a network to which the gateway is attached. The gateway, G1, checks its routing table and obtains the address of the next gateway, G2, on the route to the datagram's internet destination network, X. If G2 and the host identified by the internet source address of the datagram are on the same network, a redirect message is sent to the host. The redirect message advises the host to send its traffic for network X directly to gateway G2 as this is a shorter path to the destination. The gateway forwards the original datagram's data to its internet destination. For datagrams with the IP source route options and the gateway address in the destination address field, a redirect message is not sent even if there is a better route to the ultimate destination than the next address in the source route. Codes 0, 1, 2, and 3 may be received from a gateway. RFC 816, page 3: The ICMP "redirect" message indicates that the gateway to which the host sent the datagram is no longer the best gateway to reach the net in question. The gateway will have forwarded the datagram, but the host should revise its routing table to have a different immediate address for this net. RFC 1349, page 9: The ICMP Redirect message also includes a code, which specifies the class of datagrams to which the Redirect applies. There are currently four codes defined: 0 -- redirect datagrams for the network. 1 -- redirect datagrams for the host. 2 -- redirect datagrams for the type of service and network. 3 -- redirect datagrams for the type of service and host.

1 0

Decent site explaining Server firewalls
by Leo Mauler 07 Sep '05

07 Sep '05

I'm taking a class on RHCE and the instructor just passed on this website for server firewall info. Nice basic stuff for Linux beginners and it builds your knowledge from basic to advanced in the same site (such as creating a server firewall which blocks most traffic but which opens up enough for NFS, which is quite tricky). http://www.troubleshooters.com/lpm/200305/200305.htm ______________________________________________________ Click here to donate to the Hurricane Katrina relief effort. http://store.yahoo.com/redcross-donate3/

1 0

RE: routing problem - fork on gateways
by Jeremy Fowler 06 Sep '05

06 Sep '05

> > So your router and firewall are two separate machines? > Seems redundant to me, most firewalls do routing as well. > The only reason you would need a router is if the firewall > wasn't on the same subnet. > > No, it's standard practice for the ultraparanoid. > > The idea is, if your outer wall is compromised, hopefully you can > limit the damage > before Kevin Mitnick gets all the way into your shorts. > > You might want to put a honeypot in there too. Not in this scenario. The firewall is on the SAME subnet as the router and hosts. If the firewall was compromised, there would be nothing stopping it from attacking the rest of the hosts. In order to establish a DMZ, he needs to place the firewall on a separate subnet off from the rest of the network for it to be secured like in my second example. He would need to VLAN off that connection as well, or use a separate switch not connected to the LAN.

4 6

RE: routing problem - fork on gateways
by Jeremy Fowler 06 Sep '05

06 Sep '05

> what gets bypassed with established TCP connections > is the firewall rules, as an optimization for reducing CPU load > on firewall machines. That's TCP connections, not routes. > Routes must involve routers unless there is direct connection, > (or faking of direct connection through VPN bridging or something > like that) Nope, you can always source route a packet. Unless a host along the path filters them. However, in the case there is nothing to stop a application from source routing directly to the firewall and bypassing the router. However, the application would have to specifically do this as it is not done automatically.

1 0

Re: [OT] Katrina
by raldenfranklin＠everestkc.net 04 Sep '05

04 Sep '05

Jason Clinton wrote: >Well, this post is decidedly off-topic but the horror of watching the worst in >humanity unfold over the past week as left me feeling like doing more. That's >why I'm posting this request for donations. If you would like to contribute, >I would like to pass along this recommendation: > >http://www.americares.org/ > >The recommendation comes from several organizations which I respect: >* the Council for Secular Humanism >* the Center for Inquiry >* Skeptical Inquirer >* The Committee for the Scientific Investigation of Claims of the Paranormal > >I am intentionally not recommending the Red Cross due to their handling of >money received for victums of the terrorist attacks in 2001. > > Thank you, Jason. good recommendation. one may also consider: http://www.directrelief.org/ " Direct Relief International is a non-profit, non-political, and non-sectarian organization that provides assistance without regard to race, ethnicity, political or religious affiliation, gender, or ability to pay. We are committed to making every dollar count less than 1% of our support goes to administrative and fundraising expenses". Peace, Rick

1 0

[OT] Katrina
by Jason Clinton 04 Sep '05

04 Sep '05

Well, this post is decidedly off-topic but the horror of watching the worst in humanity unfold over the past week as left me feeling like doing more. That's why I'm posting this request for donations. If you would like to contribute, I would like to pass along this recommendation: http://www.americares.org/ The recommendation comes from several organizations which I respect: * the Council for Secular Humanism * the Center for Inquiry * Skeptical Inquirer * The Committee for the Scientific Investigation of Claims of the Paranormal I am intentionally not recommending the Red Cross due to their handling of money received for victums of the terrorist attacks in 2001. -- I use digital signatures and encryption. My key is stored at pgp.mit.edu key ID code: "0x8DB3BF09". F: F628 D9D3 E57A C281 5EFE 7DF7 B52A A393 8DB3 BF09

1 0

RE: routing problem - fork on gateways
by hanasaki 03 Sep '05

03 Sep '05

My current network is a hybrid of the below A and B and also not yet finished. I suppose it is most like B with the firewall and router split in two boxes and the router only having one NICE. The plan is to get to Picture A and build the honeypot at some later time. You do bring up a good point about the bypassing of the router. This is addressed with iptables on the firewall. It will only alot outgoing traffic from the router. The only way to the firewall is the console or ssh from the router. Also the fw is a 166 (i know thats overkill for a basic Linux firewall) The router runs internal dhcp and dns, external and internal webservers and email and imap an squid. They will all be split if the scalibiltiy is needed. For now, they all have cname alias' so the hostnames are at least unique. Actual topoligy: +----------+ | internet | +----------+ | | firewall +------------+ | 10.1.1.1 | +------------+ | | +-----------+ | 10.1.1.2 | router | | (one nic) +-----------+ | | +----------+ | localnet | (switch 2) +----------+ =========== If the firewall is compromised there is no way to prevent any computer connected to any network that has internet access from being attacked no matter how elegant your network design. I find the it is better to use a simple network plan from a safe-yourself-headaches perspective. I much prefer this type of set up +----------+ | internet | +----------+ | | firewall honeypot +------------+ +-----------+ | 10.1.1.1 | ------ | 10.1.1.10 | (switch 1) +------------+ +-----------+ | | +-----------+ | 10.1.1.2/ | router | 172.1.1.1 | (two nics) +-----------+ | | +----------+ | localnet | (switch 2) +----------+ Picture A However, I do not have a honeypot currently and hence no need to seperate the firewall and router, thus negating the need for two switches. Also, I use my firewall/router as the gateway so one of the two nics has a real world ip and the other is to the local lan. >From what I can see of the network here described the firewall is the gateway to the internet, but there is something meissing from the description. I see the router as a useless box on the network and any pc connected to the network can bypass the router and route directly through the firewall. This is the network I see described. (internet) ---- (cablemodem) | | [ real ip addr ] (gateway/firewall?) [10.1.1.1] | __________|_____________________ | | | 10.1.1.30 10.1.1.10 10.1.1.2 host 1 host 3 host 2 (router) Picture B Now an intelligent ip protocol will bypass the router once it has found the gateway, so traffic only goes through the router the first time. Correct me if I'm wrong in any of this. I don't see the internet gateway in the description of the LAN anywhere, so I've assumed that the firewall is the gateway. I see only the firewall with a local address connected to the cable modem, which I don't think will work the way described. Something here has to be connected to two networks (LAN & internet). Brian JD

1 0

Installing FC4 on new HD
by Jon Moss 01 Sep '05

01 Sep '05

I had a hard drive die a couple of weeks ago so I eBayed a new one and it arrived yesterday. I'm installing FC4 now. However, I wasn't paying attention (yes, I didn't RTFS) and went flying by the screen for DHCP or Manual IP. I wanted Manual IP. I also forgot to grab the memory out of the old server and put it in this one. Anyway, I know I can change the DHCP to manual when I'm done. But where/when will it ask me for the name of the server? Did I fly by that screen as well? -- Thanks very much, Jon Moss jon.moss(a)cnonline.net

2 1

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

KCLUG