Comments inline... Warning: Suggested IPChains lines may wrap. > LPR - Dachstien v1.02-1680 > Kernel 2.2.19-3-LEAF > > 1. IPCHAINS - I want to block incoming ping and incoming trace routes. > What is the correct syntax and where should it go in the ipfilter.conf?
You can put custom rules in /etc/ipchains.input. Pings are ICMP message 8 (echo request), so you want something like: $IPCH -A input -j DENY -p icmp --icmp-type echo-request -i $EXTERN_IF Traceroutes are a bit harder...a remote system does a traceroute to a destination by sending out a packet with a short TTL (time-to-live), and listening for return ICMP time-exceeded messages from the intermediate hosts (the TTL field of a packet is decremented each time it passes through a router). You can use most any IP packet for this. By default, linux traceroute uses UDP packets sent to port 33434, but any UDP or TCP port (and even protocols other than TCP/UDP) can be used, so it's kind of hard to block on the input side. You can, however, block the return ICMP time-exceeded messages in the output chain. Put the following in /etc/ipchains.output $IPCH -A output -j DENY -p icmp --icmp-type time-exceeded -i $EXTERN_IF > 2. Silent_Deny - In the network.conf there is a comment statement for > Silent_Deny. #SILENT_DENY='udp_207.235.84.1_route udp_207.35.84.0/24_37" > > How do I take the below statements and convert them into SILENT_DENY > statements? > > Packet log: input DENY eth0 PROTO=2 68.100.55.195:65535 > 239.255.255.250:65535 L=32 S=0x00 I=40439 F=0x0000 T=1 O=0x00000494 > Packet log: input DENY eth0 PROTO=2 68.100.52.47:65535 > 239.255.255.250:65535 L=32 S=0x00 I=41669 F=0x0000 T=1 O=0x00000494 You can leave off the destination port for protocols that don't require it, so the above becomes: SILENT_DENY="2_68.100.55.195 2_68.100.52.47" Charles Steinkuehler http://lrp.steinkuehler.net http://c0wz.steinkuehler.net (lrp.c0wz.com mirror) ------------------------------------------------------- This sf.net email is sponsored by: viaVerio will pay you up to $1,000 for every account that you consolidate with us. http://ad.doubleclick.net/clk;4749864;7604308;v? http://www.viaverio.com/consolidator/osdn.cfm ------------------------------------------------------------------------ leaf-user mailing list: [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/leaf-user SR FAQ: http://leaf-project.org/pub/doc/docmanager/docid_1891.html
