Re: trying to tweek FW and / or ruleset

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



On Sun, Feb 13, 2005 at 02:39:31PM +0200, Brent Clark wrote:
> echo 1 > /proc/sys/net/ipv4/ip_dynaddr  #This may help if you have a 
> dynamic IP address \(e.g. slip, ppp, dhcp\)
> echo 1 > /proc/sys/net/ipv4/conf/all/log_martians       #Enable logging 
> for malformed Ip Address

"malformed IP Address" seems like an odd way to describe that.  the IP
address isn't malformed, it's not considered to be a valid source
address on the inbound interface; i.e., it's "alien."

> echo 1 > /proc/sys/net/ipv4/ip_forward
> echo 1 > /proc/sys/net/ipv4/conf/all/proxy_arp

i would be surprised if you want proxy_arp set to 1, unless you're
trying to do something semi-strange.  i could be mistaken...

> echo 0 > /proc/sys/net/ipv4/conf/all/rp_filter

since you're enabling martian logging above, why are you disabling the
feature that detects martians?  "normally" you'd want rp_filter set to 1
on all interfaces, unless you know you're doing something intentionally
that won't work with it enabled.

> echo 1 > /proc/sys/net/ipv4/icmp_echo_ignore_broadcasts
> echo 0 > /proc/sys/net/ipv4/conf/all/accept_source_route
> echo 0 > /proc/sys/net/ipv4/conf/all/accept_redirects

-j

--
"Shut up brain or I'll stab you with a Q-Tip."
        --The Simpsons


[Index of Archives]     [Linux Netfilter Development]     [Linux Kernel Networking Development]     [Netem]     [Berkeley Packet Filter]     [Linux Kernel Development]     [Advanced Routing & Traffice Control]     [Bugtraq]

  Powered by Linux