tech-net archive

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index][Old Index]

Re: ipfilter, return-icmp and RFC1122

Jim Wise wrote:
On Wed, 4 Jun 2008, Petar Bogdanovic wrote:

>    +block return-rst  in proto tcp
>    +block return-icmp in proto udp

Note that a quick fix would be to treat the broadcast address `specially'
for these rules.  So replace the above with:


    block from any to $broadcast_addr
    block return-rst  in proto tcp
    block return-icmp(port-unr) in proto udp from any to $my_addr
    block return-icmp in proto udp

This should give the most `realistic' error responses for your non-open
ports, unless I'm missing something (entirely possible).

You don't need to specify the broadcast address:

block in quick all with bcast

And if you needed to do this for both broadcast and multicast:

block in quick all with mbcast


Home | Main Index | Thread Index | Old Index