Subject: Re: Ignore incoming ICMP redirect packets
To: Matthias Scheler <email@example.com>
From: Jonathan Stone <jonathan@DSG.Stanford.EDU>
Date: 02/19/2000 13:45:08
Matthias Scheler wries:
> Manuel Bouyer <firstname.lastname@example.org> writes:
>> A sysctl net.inet.ip.acceptredirects would be nice.
>Yes, indeed. IPF works fine - thanks for the filter rule Darren - but
>is an overkill just to ignore ICMP redirects.
The Freebsd 4.0 snapshot release notes say:
FB40> Support has been added for blocking incoming ICMP redirects, outgoing RST
FB40> frames and incoming SYN|FIN frames in order to lessen or nullify the
FB40> impact of certain kinds of DoS attacks. [MERGED]
FB40> Support has been added for forwarding IP datagrams without inspecting or
FB40> decreasing the TTL in order to make gateways and firewalls less visible
Any chance we could use the same sysctl name(s)? I cant tell if this
means blocking redirects for hosts that aren't routers. If so,
that sounds like a separate function.
The RST frame blocking and SYN!FIN blocking sound interesting too.