> Larry Menten wrote:
> 
> >There must be a way to distinguish locally
> originated/terminated traffic.
> >
> >Linux provides hooks (NF_*_LOCAL_IN/OUT) for locally
> originated/terminated traffic that supports this
> nicely.  Without such a hook it is difficult to
> protect the firewall host with a more restrictive
> policy than fused for routed traffic.
> >
> >Solaris pfh does provide NH_FORWARDING, but the
> feature needs NH_LOCAL_IN and NH_LOCAL_OUT as well.
> >
> >Have I overlooked something?
> >  
> >
> 
> No, we have only designed it in accordance with what
> people need.
> 
> At the time it was designed and developed, there was
> no requirement
> for LOCAL_IN or LOCAL_OUT.
> 
> At present determining whether or not traffic has
> originated from
> the host (or is destined for it) should be a result
> of looking more
> deeply at packet headers.
> 
> Darren

Darren,

>From my read, it looks like one would need to track the coming and going of 
>logical interfaces to learn what IP addresses are being used by the local host 
>on each physical interface.  One would maintain a table of these addresses and 
>look up either the destination address of each packet received or the source 
>address of each packet transmitted to learn if it was locally originated or 
>terminated.  

This would also require being careful about where address translation is 
performed.

Is this the recommended approach?

Larry
 
 
This message posted from opensolaris.org
_______________________________________________
networking-discuss mailing list
[email protected]

Reply via email to