Anti-Spoofing - no-route

2004-03-03 Thread Damian McGuckin 

What is the difference between the 2 block'ing rules below

... table garbage { 127/8, 10/8, 172.16/12, 192.168/16, 255.255.255.255/32 }

... block in log quick on $exIF from no-route to any
... block in log quick on $exIF from garbage to any

i.e. what does no-route expand to.

The manual entry talks about no-route being any address that is not
currently routable. However, as I am routing 192.168.0.0/24 internally,
does that not get excluded?  I certainly do NOT want to see a source
address coming in from the outside with the same IPs as my own internal
addresses.

Are these rules redundant or complimentary?

Thanks - Damian

NOW - if my short explanation was too brief or poorly worded 

PF filters between an external set of IPs, say 202.202.202.0/24 and an
internal network, 192.168.0.0/24.

Let's assume I want a bidirectional NAT of 202.202.202.145 on the
host which, behind the firewall is 192.168.0.145.  That is, I want
the outside world to think my host is 202.202.202.145.

The relevant pieces of /etc/pf.conf are

... exIF=de0
... mail=192.168.0.145

... table garbage { 127/8, 10/8, 172.16/12, 192.168/16, 255.255.255.255/32 }

... scrub in all

... # Expose A Host

... binat on $exIF from 192.168.0.145 to any - 202.202.202.145

... # No spoofing

... block in  log quick on $exIF from no-route to any
... block in  log quick on $exIF from garbage to any

... # Pass through rules follow later

... pass in quick on $exIF\
...proto tcp from any to 192.168.0.145 port 25 keep state

P.S. As soon as I saw the 'caveat' on the antispoof rule, I got worried.
When I couldn't find examples, I just gave up on it.

Pacific Engineering Systems International, 22/8 Campbell St, Artarmon NSW 2064
Ph:+61-2-99063377 .. Fx:+61-2-99063468   | unsolicited email not wanted here !
Views and opinions here are mine and not those of any past or present employer

Re: Anti-Spoofing - no-route

2004-03-03 Thread Daniel Hartmeier 
On Wed, Mar 03, 2004 at 09:24:41PM +1100, Damian McGuckin wrote:

 What is the difference between the 2 block'ing rules below
 
 ... table garbage { 127/8, 10/8, 172.16/12, 192.168/16, 255.255.255.255/32 }
 
 ... block in log quick on $exIF from no-route to any
 ... block in log quick on $exIF from garbage to any
 
 i.e. what does no-route expand to.

They are very different, no-route doesn't expand at all, but is
evaluated at run-time, matching addresses which the pf box doesn't have
routes to at the time of evaluation.

If your pf box has a default route configured, no-route is useless, as
you have a route to any address (through that default gateway). It only
makes sense on hosts without a default route. And there's no relation to
'unroutable' addresses like 192.168/16 or 10/8 at all, your host may
very well have routes to such networks.

On hosts without a default route, however, no-route can be used for
antispoof-like constructs. For instance, you might want to block
incoming packets from sources that you can't reply to, due to a lacking
route. No matter whether they be reserved addresses like 10/8 or not.

Daniel