I think it does not add so much respective to the present situation and in addition it is unapplicable: there are some ADSL modems who force the computer to use an address in the 10.x.x.x range for interfacing with them and that means that the ethernet card with an address in the 10.x.x.x is in direct contact with the Internet and, according to your proposal, unfirewalled.
On Sat, 2004-01-10 at 12:27, Alexey Eremenko wrote:
Also a nice feature to add, would be an Automatic Firewall - i.e. this type of Firewall,
will act as a Firewall on external addresses, but will NOT act as a Firewall on internal addresses like:
10.0.0.x, 192.168.x.x, etc... (RFC1918 - private IP addressing scheme).
It will especially help to people with laptops, because they won't have to configure
their Firewalls each time they connect to public, or private networks.
-Fenix*NBK*
Hotmail.co.il - Powered by IBM eServer
On Sat, 2004-01-10 at 13:34, Jean Francois Martinez wrote:
I think it does not add so much respective to the present situation and in addition it is unapplicable: there are some ADSL modems who force the computer to use an address in the 10.x.x.x range for interfacing with them and that means that the ethernet card with an address in the 10.x.x.x is in direct contact with the Internet and, according to your proposal, unfirewalled.
You forgot to mention that most home users are in this described situation. Besides that I often use my laptop at the university network with serveral hundred (or maybe thousand?) hosts on the network, all using a private ip-address range... Then I also like to be secured against the evil users on that network.
Martin Sturm
On Sat, Jan 10, 2004 at 01:34:01PM +0100, Jean Francois Martinez wrote:
I think it does not add so much respective to the present situation and in addition it is unapplicable: there are some ADSL modems who force the computer to use an address in the 10.x.x.x range for interfacing with them and that means that the ethernet card with an address in the 10.x.x.x is in direct contact with the Internet and, according to your proposal, unfirewalled.
It adds a fair bit if you add a "Masquerade" tick box to the existing network configuration bits.
On Sat, 10 Jan 2004, Alan Cox wrote:
On Sat, Jan 10, 2004 at 01:34:01PM +0100, Jean Francois Martinez wrote:
address in the 10.x.x.x is in direct contact with the Internet and, according to your proposal, unfirewalled.
It adds a fair bit if you add a "Masquerade" tick box to the existing network configuration bits.
BTW, I've been wondering loooong time why default FW has not been stateful?
Ok, IIRC iptables were not default before 8.0, but since then I have not understood why not. Is it just that there is no simple configuration tool for it yet or is there some other reason?
We have been using iptables (w/ state/conntrack) over a year now, and really busy (backups, proxies, ftp servers, ldap & kerberos, DHCP & DNS servers ...) systems with only minor problems in the beginning, but that was mostly with something like when using VLAN's, but that's been working about a year now.
First thing I've done past year rightafter installation is to replace the lokkit created ipfilter from simple template like the following
http://people.jyu.fi/~mesrik/rpms/ipfilter/ipfilter.templ
We haul terabytes of data each month trough it have no problems at all.
Any reason not to ship a stateful filter by default? It would make people with less experience with networking easier to get things working out of box and withouth necessarily punching silly holes in initscripts and like. (Haven't looked recently if those are still there ...)
Above template allows directly to client use DHCP, NTP, NFS, etc. without a single line modification. Only the incoming connections need to be customized and ONLY in server use and providing services to other computers, workstations do not necessarily need to be touched. A simple python/perl script could do that if nothing else.
Any plans yet?
:-) riku
ps. It would be nice if quota from redhat would be upgraded too. quota-3.06 currently at rawhide etc. is too old for rpc.quotad port fixing, newest is 3.10. For more details, see http://www.ba.infn.it/calcolo/documenti/NFSServer.html#Firewall
On Sat, 2004-01-10 at 15:21, Riku Meskanen wrote:
BTW, I've been wondering loooong time why default FW has not been stateful?
[snip]
Any reason not to ship a stateful filter by default? It would make people with less experience with networking easier to get things working out of box and withouth necessarily punching silly holes in initscripts and like. (Haven't looked recently if those are still there ...)
Above template allows directly to client use DHCP, NTP, NFS, etc. without a single line modification. Only the incoming connections need to be customized and ONLY in server use and providing services to other computers, workstations do not necessarily need to be touched. A simple python/perl script could do that if nothing else.
Any plans yet?
I felt the same and submitted patches in Aug 2003.
Fedora Core v1 and Red Hat Enteprise Linux v3 both create stateful firewalls by default. No breakage for locally initiated connections. Big improvement over RHL9 and earlier.
Didn't you read the Release Notes?
Dax Kelson Guru Labs
On Sat, 10 Jan 2004, Dax Kelson wrote:
I felt the same and submitted patches in Aug 2003.
Fedora Core v1 and Red Hat Enteprise Linux v3 both create stateful firewalls by default. No breakage for locally initiated connections. Big improvement over RHL9 and earlier.
Didn't you read the Release Notes?
Hmmm, I must admit that very briefly and I missed that point, sorry. I'm going to reread it just now, thanks.
:-) riku