Larry Menten wrote: >> Larry Menten wrote: >> >> >>> There must be a way to distinguish locally >>> >> originated/terminated traffic. >> >>> Linux provides hooks (NF_*_LOCAL_IN/OUT) for locally >>> >> originated/terminated traffic that supports this >> nicely. Without such a hook it is difficult to >> protect the firewall host with a more restrictive >> policy than fused for routed traffic. >> >>> Solaris pfh does provide NH_FORWARDING, but the >>> >> feature needs NH_LOCAL_IN and NH_LOCAL_OUT as well. >> >>> Have I overlooked something? >>> >>> >>> >> No, we have only designed it in accordance with what >> people need. >> >> At the time it was designed and developed, there was >> no requirement >> for LOCAL_IN or LOCAL_OUT. >> >> At present determining whether or not traffic has >> originated from >> the host (or is destined for it) should be a result >> of looking more >> deeply at packet headers. >> >> Darren >> > > Darren, > > >From my read, it looks like one would need to track the coming and going of > >logical interfaces to learn what IP addresses are being used by the local > >host on each physical interface. One would maintain a table of these > >addresses and look up either the destination address of each packet received > >or the source address of each packet transmitted to learn if it was locally > >originated or terminated. > > This would also require being careful about where address translation is > performed. > > Is this the recommended approach? >
That is one approach that can be taken, yes. I should also have mentioned that you should feel free to look through IP and recommend where to place _LOCAL_IN/_LOCAL_OUT hooks with a patch or two :) Darren _______________________________________________ networking-discuss mailing list [email protected]
