On Fri, Dec 05, 2003 at 04:11:42PM +0200, Ray Leach wrote: > On Fri, 2003-12-05 at 16:01, Gabby James wrote: > > Hi, > > I want to allow everything on eth1 and be selective on eth0. What is the > > best way of handling unwanted packets? > > A) Change the policy of the chain to DROP then allow what I want. Example: > > iptables -P INPUT DROP > > iptables -A INPUT -p tcp -m tcp --dport 22 --syn -j ACCEPT > > B) or leave the policy of the INPUT chain to ACCEPT but put REJECT rules at > > the end. Example: > > iptables -A INPUT -p tcp -m tcp --dport 22 --syn -j ACCEPT > > iptables -A INPUT -p tcp -m tcp -j REJECT > > iptables -A INPUT -p udp -m udp -j REJECT > > iptables -A INPUT -p icmp -j DROP > > This will give me the same outcome won't it? > No, none of your rules reference the interface, e.g -i eth0 > So your rules allow/reject on all interfaces. One HUGE difference between A and B is what's not seen in there at all. Not all protocols are tcp, udp, or icmp. There's also things like AH, ESP, SIT (aka IPv6), and GRE. All of these things would be blocked by A and will pass straight through B unempeded. SIT, especially, could be problematical since an attacker could simply set up and IPv6 over IPv4 tunnel that will pass straight through your firewall and route entire subnets out to the Internet. With 6to4 (6over4 using the 2002::/16 TLA) they don't even need static IPv6 configurations. If you let that pass through, your IPv4 iptables won't even see tcp or udp in that tunnel, all it will see is IPv4 protocol 41 (SIT/ipv6). Even if you have iptables6 loaded, it wont see tcp or udp on IPv6, because it's IPv4 protocol 41 and not seen by the IPv6 iptables at all. So, either way, that protocol has to be stopped or you may end up with IPv6 on your network and never realize it or successfully filter it. Always remember... There's more riding on the next layer up than just tcp, udp, and icmp. A lot more. And what you don't know can come back to bite you. > > Thanks in advance! > > _________________________________________________________________ > > Winterize your home with tips from MSN House & Home. > > http://special.msn.com/home/warmhome.armx > -- > -- > Raymond Leach <raymondl@xxxxxxxxxxxxxxxxxxxxxx> > Network Support Specialist > http://www.knowledgefactory.co.za > "lynx -source http://www.rchq.co.za/raymondl.asc | gpg --import" > Key fingerprint = 7209 A695 9EE0 E971 A9AD 00EE 8757 EE47 F06F FB28 > -- Mike -- Michael H. Warfield | (770) 985-6132 | mhw@xxxxxxxxxxxx /\/\|=mhw=|\/\/ | (678) 463-0932 | http://www.wittsend.com/mhw/ NIC whois: MHW9 | An optimist believes we live in the best of all PGP Key: 0xDF1DD471 | possible worlds. A pessimist is sure of it!
Attachment:
pgp00690.pgp
Description: PGP signature
