tech-net archive

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index][Old Index]

Re: ipfilter, return-icmp and RFC1122

Darren Reed wrote:
Jim Wise wrote:
On Wed, 4 Jun 2008, Petar Bogdanovic wrote:

>    +block return-rst  in proto tcp
>    +block return-icmp in proto udp

Note that a quick fix would be to treat the broadcast address `specially'
for these rules.  So replace the above with:


    block from any to $broadcast_addr
    block return-rst  in proto tcp
    block return-icmp(port-unr) in proto udp from any to $my_addr
    block return-icmp in proto udp

This should give the most `realistic' error responses for your non-open
ports, unless I'm missing something (entirely possible).

You don't need to specify the broadcast address:

block in quick all with bcast

And if you needed to do this for both broadcast and multicast:

block in quick all with mbcast

And you can also do:

block in quick on fxp0 from any to fxp0/bcast

(interface name in the "address" field must match the "on" name)


Home | Main Index | Thread Index | Old Index