> Larry Menten wrote: > > >There must be a way to distinguish locally > originated/terminated traffic. > > > >Linux provides hooks (NF_*_LOCAL_IN/OUT) for locally > originated/terminated traffic that supports this > nicely. Without such a hook it is difficult to > protect the firewall host with a more restrictive > policy than fused for routed traffic. > > > >Solaris pfh does provide NH_FORWARDING, but the > feature needs NH_LOCAL_IN and NH_LOCAL_OUT as well. > > > >Have I overlooked something? > > > > > > No, we have only designed it in accordance with what > people need. > > At the time it was designed and developed, there was > no requirement > for LOCAL_IN or LOCAL_OUT. > > At present determining whether or not traffic has > originated from > the host (or is destined for it) should be a result > of looking more > deeply at packet headers. > > Darren
Darren, >From my read, it looks like one would need to track the coming and going of >logical interfaces to learn what IP addresses are being used by the local host >on each physical interface. One would maintain a table of these addresses and >look up either the destination address of each packet received or the source >address of each packet transmitted to learn if it was locally originated or >terminated. This would also require being careful about where address translation is performed. Is this the recommended approach? Larry This message posted from opensolaris.org _______________________________________________ networking-discuss mailing list [email protected]
