Yes, I've already talked to them today and they were a bit suprised and started
working on it promptly...

Here are some details.

My static DSL single class IP is 207.225.204.x/32 on eth0 and the internal LAN is
192.168.1.0/24 on eth0:

ipfwadm -I -f
ipfwadm -O -f
ipfwadm -F -f

ipfwadm -F -v -a deny                    -S 0.0.0.0/0          -D 0.0.0.0/0 -o

#xDSL
ipfwadm -F -v -a masquerade -W eth0      -S 192.168.1.0/24     -D 0.0.0.0/0
ipfwadm -I -v -a accept     -V 127.0.0.1 -S 192.168.1.0/24     -D 0.0.0.0/0

# Allow ACK packets in
ipfwadm -F -a accept -m -P tcp -S 0.0.0.0/0                    -D 0.0.0.0/0
# Give friendly sites complete access
ipfwadm -F -a accept -b -P tcp -S x.x.x.x/24                   -D 0.0.0.0/0
ipfwadm -F -a accept -b -P tcp -S x.x.x.x/24                   -D 0.0.0.0/0
# SMTP Servers in and out
ipfwadm -F -a accept -b -P tcp -S 0.0.0.0/0        1024:65535  -D 208.225.204.x/32 25

# HTTP Servers in and out
ipfwadm -F -a accept -b -P tcp -S 0.0.0.0/0        1024:65535  -D 208.225.204.x/32 80

# DNS Servers in and out
ipfwadm -F -a accept -b -P tcp -S 0.0.0.0/0                    -D 208.225.204.x/32 53

ipfwadm -F -a accept -b -P udp -S 0.0.0.0/0                    -D 208.225.204.x/32 53

# Telnet Servers in and out
ipfwadm -F -a accept -b -P tcp -S 208.225.204.x/32 1024:65535  -S 0.0.0.0/0        23

I've tried placing the -W eth0 on each linewith the same results; all traffic is
blocked.  I am making one basic assumption, which may not be safe, but that is that
all F/W filtering is based on the real IP address and not the fake ones since the
fake ones are technically not in the accessible range...

Barry

Fuzzy Fox wrote:

> Barry Treahy <[EMAIL PROTECTED]> wrote:
> >
> > On packet filtering routers I use, I apply the filter to the interface
> > but when I attempt to apply the same technique with blocking filters
> > to the Linux masqing system, it ignores the interface and blocks
> > packets in the wrong direction.
>
> That's strange; can you post an example that demonstrates this?  In my
> experience, it works the right way.
>
> > Ps.  there is no ppp on this, pure ethernet using DSL.  My DSL ISP
> > bridges which means I see all sorts of IP, IPX, Netbios traffic from
> > other costs on the central hub.  I'd like to plug this hole to my
> > system...
>
> Not only is that a security problem for your system, it's also a drain
> on your limited DSL bandwidth!  Shouldn't you complain to your provider
> and get them to stop sending you traffic that you don't want to carry on
> your DSL?
>
> --
>    [EMAIL PROTECTED] (Fuzzy Fox)      || "Nothing takes the taste out of peanut
> sometimes known as David DeSimone  ||  butter quite like unrequited love."
>   http://www.dallas.net/~fox/      ||                       -- Charlie Brown
>
> _______________________________________________
> Masq maillist  -  [EMAIL PROTECTED]
> http://tiffany.indyramp.com/mailman/listinfo/masq
> Admin requests can be handled by web (above) or [EMAIL PROTECTED]




_______________________________________________
Masq maillist  -  [EMAIL PROTECTED]
http://tiffany.indyramp.com/mailman/listinfo/masq
Admin requests can be handled by web (above) or [EMAIL PROTECTED]

Reply via email to