Yes, I've already talked to them today and they were a bit suprised and started working on it promptly... Here are some details. My static DSL single class IP is 207.225.204.x/32 on eth0 and the internal LAN is 192.168.1.0/24 on eth0: ipfwadm -I -f ipfwadm -O -f ipfwadm -F -f ipfwadm -F -v -a deny -S 0.0.0.0/0 -D 0.0.0.0/0 -o #xDSL ipfwadm -F -v -a masquerade -W eth0 -S 192.168.1.0/24 -D 0.0.0.0/0 ipfwadm -I -v -a accept -V 127.0.0.1 -S 192.168.1.0/24 -D 0.0.0.0/0 # Allow ACK packets in ipfwadm -F -a accept -m -P tcp -S 0.0.0.0/0 -D 0.0.0.0/0 # Give friendly sites complete access ipfwadm -F -a accept -b -P tcp -S x.x.x.x/24 -D 0.0.0.0/0 ipfwadm -F -a accept -b -P tcp -S x.x.x.x/24 -D 0.0.0.0/0 # SMTP Servers in and out ipfwadm -F -a accept -b -P tcp -S 0.0.0.0/0 1024:65535 -D 208.225.204.x/32 25 # HTTP Servers in and out ipfwadm -F -a accept -b -P tcp -S 0.0.0.0/0 1024:65535 -D 208.225.204.x/32 80 # DNS Servers in and out ipfwadm -F -a accept -b -P tcp -S 0.0.0.0/0 -D 208.225.204.x/32 53 ipfwadm -F -a accept -b -P udp -S 0.0.0.0/0 -D 208.225.204.x/32 53 # Telnet Servers in and out ipfwadm -F -a accept -b -P tcp -S 208.225.204.x/32 1024:65535 -S 0.0.0.0/0 23 I've tried placing the -W eth0 on each linewith the same results; all traffic is blocked. I am making one basic assumption, which may not be safe, but that is that all F/W filtering is based on the real IP address and not the fake ones since the fake ones are technically not in the accessible range... Barry Fuzzy Fox wrote: > Barry Treahy <[EMAIL PROTECTED]> wrote: > > > > On packet filtering routers I use, I apply the filter to the interface > > but when I attempt to apply the same technique with blocking filters > > to the Linux masqing system, it ignores the interface and blocks > > packets in the wrong direction. > > That's strange; can you post an example that demonstrates this? In my > experience, it works the right way. > > > Ps. there is no ppp on this, pure ethernet using DSL. My DSL ISP > > bridges which means I see all sorts of IP, IPX, Netbios traffic from > > other costs on the central hub. I'd like to plug this hole to my > > system... > > Not only is that a security problem for your system, it's also a drain > on your limited DSL bandwidth! Shouldn't you complain to your provider > and get them to stop sending you traffic that you don't want to carry on > your DSL? > > -- > [EMAIL PROTECTED] (Fuzzy Fox) || "Nothing takes the taste out of peanut > sometimes known as David DeSimone || butter quite like unrequited love." > http://www.dallas.net/~fox/ || -- Charlie Brown > > _______________________________________________ > Masq maillist - [EMAIL PROTECTED] > http://tiffany.indyramp.com/mailman/listinfo/masq > Admin requests can be handled by web (above) or [EMAIL PROTECTED] _______________________________________________ Masq maillist - [EMAIL PROTECTED] http://tiffany.indyramp.com/mailman/listinfo/masq Admin requests can be handled by web (above) or [EMAIL PROTECTED]
