Subject: Re: Ye olde PR #991 - packets destined for interface IP# are accepted regardless of which interface they arrive on.
To: Michael Richardson <>
From: Andrew Brown <>
List: tech-net
Date: 05/06/2000 14:35:57
>    Erik> If you're not a router (IPFORWARDING=0), then the strict
>    && IPFILTER==0
>    Erik> destination code should be on, and packets that came in from the
>    Erik> wrong interface should be rejected.
>  If I'm a firewall, then I have IPFORWARDWING on, since I want to forward.
>But, I still want strict address checking, since it makes my rules a lot

if you're a firewall, you should have ipforwarding off and you should
be proxying services.  if you're forwarding packets, you're *NOT* a

if you're a packet filtering router, then you have forwarding on, and
this code doesn't help you, since you can expect to be receiving many
packets on many interfaces with destination addresses that aren't

|-----< "CODE WARRIOR" >-----|             * "ah!  i see you have the internet (Andrew Brown)                that goes *ping*!"       * "information is power -- share the wealth."