Hello folks. Im trying to get my OpenBSD 3.5 machine set up as a router. Heres
the info so far:
xl0 network card getting dhcp address from my isp
ep1 network card hooked to my laptop 192.168.1.1 netmask 255.255.255.0
The laptop is windows and has 192.168.1.2 as its ip. I can ping the laptop, a
Hello folks. Thanks to everyone who responded to my problem. The laptop can use
the internet now, however it wont resolve host names properly. For example, it
wouldnt connect to www.google.ca but it would to 64.233.167.104
Same for IRC, xhat wouldnt connect to eu.undernet.org but it would connec
R T wrote:
Hello folks. Im trying to get my OpenBSD 3.5 machine set up as a router. Heres
the info so far:
xl0 network card getting dhcp address from my isp
ep1 network card hooked to my laptop 192.168.1.1 netmask 255.255.255.0
Well, first thing's first. If 192.168.1.1 is the IP of ep1, does y
On Wed, Jan 19, 2005 at 09:04:30AM -0700, R T wrote:
> Hello folks. Im trying to get my OpenBSD 3.5 machine set up as a router.
> Heres the info so far:
> xl0 network card getting dhcp address from my isp
> ep1 network card hooked to my laptop 192.168.1.1 netmask 255.255.255.0
>
> The laptop i
Hi Peter,
I am a newbie as well, but after some time banging my
head against walls I came up with my own 'silly'
pf.conf rules. I have included my rules at the end of
this email. I Removed the extra rules (I think all of
them) and all you have to do is change the variable
names to whatever you are
On Wed, Jan 19, 2005 at 02:07:10PM -0700, R T wrote:
> Hello folks. Thanks to everyone who responded to my problem. The laptop can
> use the internet now, however it wont resolve host names properly. For
> example, it wouldnt connect to www.google.ca but it would to 64.233.167.104
> Same for IRC
R T wrote:
Hello folks. Thanks to everyone who responded to my problem. The laptop can use the internet now, however it wont resolve host names properly. For example, it wouldnt connect to www.google.ca but it would to 64.233.167.104
Same for IRC, xhat wouldnt connect to eu.undernet.org but it wou
OOPS-
pf-r wrote:
where I've compliled a (now aging) list of
s/compliled/compiled
BTW, if anyone wants to submit pf.conf examples with accompanying 'pfctl
-sr' (or alternative) outputs for posting on the pf-r, visit #pf and
speak up.
-S
I would like to know what I can do to improve my firewall ruleset. This exact set
protects my own internal LAN (8 computers), and includes P2P rules. I have similar
rulesets protecting other networks I have worked on, none with more than 300 clients
though.
# pF.conf working for Wall
Yeah, dns wasnt set on the laptop, not too bright today. Its working fine now.
Now to learn about making it an actual firewall :) Thanks guys for the help!
R.T.
Hiyas, although no stritly a pf question I
hope somone can answer this one for me
We have just been given a second routable
set of ip's for our servers as we hit capacity on our old one
In order to use theese for NAT I obviously
need to bind the addresses to our firew
R T wrote:
Yeah, dns wasnt set on the laptop, not too bright today. Its working fine now.
Now to learn about making it an actual firewall :) Thanks guys for the help!
R.T.
No problem, RT. Good luck.
rvb
On Mon, Jan 13, 2003 at 03:11:36PM -, Dan Heaver wrote:
> In order to use theese for NAT I obviously need to bind the addresses to our
> firewall's external interface...
> They do however need a different gateway address, where do I speciy this ?
> is is something in my hostname.rl1 file ?
Op
Eek, that should keep be busy for a while :-~
-Original Message-
From: Daniel Hartmeier [mailto:[EMAIL PROTECTED]]
Sent: 13 January 2003 16:10
To: Dan Heaver
Cc: [EMAIL PROTECTED]
Subject: Re: adding a new subnet to my firewall
On Mon, Jan 13, 2003 at 03:11:36PM -, Dan Heaver wrote
On 27 Sep 2004 09:18:27 -0700, [EMAIL PROTECTED] (Ben Therode) wrote:
>Unless I'm mistaken you can also do this via "block in quick" in the block
>rules as well.
>
No, 1st or last match have nothing to do with with block policy.
greg
--
SB: Wait, you mean the costumes themselves give you su
Ben Therode writes:
Unless I'm mistaken you can also do this via "block in quick" in the block
rules as well.
You are mistaken. The "quick" keyword simply tells pf to stop processing
at the last matching rule.
If you keep in mind that it is redundant to have "quick" in your last
rule in the config
Thankyou somuch Luke, Gragnak, Clinton Ben, Peter, Volker, Greg,
interval , for all the responses and advice!
I changed the block-policy from return to drop. Now my ports except
113 are showing up as stealthed while twsting from
http://www.grc.com/x/ne.dll?rh1dkyd2
The Port 113 was opened becaus
On Sep 28, 2004, at 2:13 AM, Siju George wrote:
I changed the block-policy from return to drop. Now my ports except
113 are showing up as stealthed while twsting from
http://www.grc.com/x/ne.dll?rh1dkyd2
The Port 113 was opened because the PF FAQ asked to open it for SMTP
"Auth/Ident (TCP port 113)
Hi Jason!
Thanks for the reply!
But if I can get port 113 also in adaptive stealth mode like Zonealarm
did then it would be better isn't it?
regards
Siju
On Tue, Sep 28, 2004 at 04:46:40PM +0530, Siju George wrote:
> But if I can get port 113 also in adaptive stealth mode like Zonealarm
> did then it would be better isn't it?
Not really. It can give a false sense of security, because you assume
the 'adaptive' part can't be tricked by the attacker.
Siju,
I am not sure what the heck this "stealth-mode" you are talking
about. Whatever grc.com is selling has taken over your thinking. You
might want to review some literature on TCP/IP and of course read the
man pages for pf.
_Raju
On Tue, 28 Sep 2004 16:46:40 +0530, Siju George <[EMAIL PROTE
on 28/9/04 12:16 pm, Siju George at [EMAIL PROTECTED] wrote:
> Hi Jason!
>
> Thanks for the reply!
>
> But if I can get port 113 also in adaptive stealth mode like Zonealarm
> did then it would be better isn't it?
If you're just trying to hide, then no. Personally I send RSTs on blocked
ports,
Hi Siju,
> The Port 113 was opened because the PF FAQ asked to open it for SMTP
>
> "Auth/Ident (TCP port 113): used by some services such as SMTP and IRC.
> ICMP Echo Requests: the ICMP packet type used by ping(8). "
I know that this is in the pf faq but I don't think that you really need it.
Siju George wrote:
I was using Zone Alarm before on a Windows200 Firewall. All its ports
were shown as Stealthed but still SMTP server access was possible!
So further digging I got this explanation from the website that
conducted the test.
""Adaptive Stealthing" means that when a TCP SYN packet arr
On Tue, 28 Sep 2004 14:08:03 +0200, Daniel Hartmeier
<[EMAIL PROTECTED]> wrote:
> On Tue, Sep 28, 2004 at 04:46:40PM +0530, Siju George wrote:
> Not really. It can give a false sense of security, because you assume
> the 'adaptive' part can't be tricked by the attacker. See
>
> http://marc.theaim
Thankyou Oliver for the reply and Explanation! It was very
informative. I'll also try the S/SAFR thing and see how it works!
God bless you
warm regards
Siju
> I know that this is in the pf faq but I don't think that you really need it. I don't
> know about IRC but you mentioned only SMTP on your side.
>
> I'm running emailservers for years now and never ran an identd. And my clients don't
> have an identd running either. I don't think that you need
> People who say identd is a source of "severe information leakage" does
> not understand what ident does. If you feel paranoid, as I do, you can
> always configure it to return "random" usernames.
>
> ---
> Lars Hansson
Hi Lars! Thanks a lot for the reply! Will manpage for identd tell me
how to
On Tue, 28 Sep 2004 14:34:54 +0200, Volker Kindermann <[EMAIL PROTECTED]> wrote:
> Hi Siju,
> > The Port 113 was opened because the PF FAQ asked to open it for SMTP
> >
> > "Auth/Ident (TCP port 113): used by some services such as SMTP and IRC.
The "auth" service (aka identd or "tap") was useful b
Siju George writes:
Hi Lars! Thanks a lot for the reply! Will manpage for identd tell me
how to return "random" usernames? Or coulld you please give me a link
where I can learn that?
http://www.clock.org/~fair/opinion/identd.html
Volker Kindermann writes:
I'm running emailservers for years now and never ran an identd. And my clients don't have an identd running either. I don't think that you need this for smtp nowadays.
identd is a protocol intended back in the day when the internet was
a connection between Bolt, Beranek, &
Kevin writes:
Many IRC servers will drop sessions if they cannot talk to an ident
service on the originating end. If you don't want your users to be on
IRC; this could be considered as a benefit of blocking TCP/113 ;)
Doubtful with IRC servers today. Although I'm not privy to the details
of IRC p
On 28 Sep 2004 10:50:02 -0700, [EMAIL PROTECTED] wrote:
> You don't
>need it, nothing now depends on it,
Not quite correct. Certain smtp, ftp and irc servers come to mind.
--
SB: Wait, you mean the costumes themselves give you super powers?
MM: Of course! Why else would we fly around in co
On Tuesday, Sep 28, 2004, at 09:47 US/Pacific, [EMAIL PROTECTED]
wrote:
Kevin writes:
Many IRC servers will drop sessions if they cannot talk to an ident
service on the originating end. If you don't want your users to be
on IRC; this could be considered as a benefit of blocking TCP/113 ;)
Dou
On Tue, Sep 28, 2004 at 04:23:43PM -0700, Trevor Talbot wrote:
> It is. It's a mitigating mechanism for many types of
> worms/bots/whatever, since they aren't capable of poking holes in their
> computer owner's broadband NAT device.
That's what UPnP is for, isn't it?
SCNR,
Daniel
On Tue, 2004-09-28 at 16:23:43 -0700, Trevor Talbot proclaimed...
> It is. It's a mitigating mechanism for many types of
> worms/bots/whatever, since they aren't capable of poking holes in their
> computer owner's broadband NAT device.
Yea, sure. I've seen *many* bots with identd running happi
On Tuesday, Sep 28, 2004, at 16:34 US/Pacific, Daniel Hartmeier wrote:
On Tue, Sep 28, 2004 at 04:23:43PM -0700, Trevor Talbot wrote:
It is. It's a mitigating mechanism for many types of
worms/bots/whatever, since they aren't capable of poking holes in
their computer owner's broadband NAT device
Siju George wrote:
Hi Lars! Thanks a lot for the reply! Will manpage for identd tell me
how to return "random" usernames? Or coulld you please give me a link
where I can learn that?
man identd, options -h and -H in particular.
OpenBSD does this by default in inetd.conf.
---
Lars Hansson
Volker Kindermann ([EMAIL PROTECTED]) wrote:
> I'm running emailservers for years now and never ran an identd. And my
> clients don't have an identd running either. I don't think that you need this
> for smtp nowadays.
It's never been mandatory for SMTP. Some IRC servers do require it,
though.
Lars Hansson wrote:
OpenBSD does this by default in inetd.conf.
Correction, it doesnt.
---
Lars Hansson
Greg Wooledge wrote:
Personally, I prefer not to reveal the usernames behind the client
connections I'm making, so I use nullidentd. It's very simplistic; it
just returns a constant string for all ident requests. (It doesn't
appear to be in ports; I simply grabbed the source code from
packages.de
On Tue, 28 Sep 2004 22:03:55 -0400, Greg Wooledge wrote:
>Personally, I prefer not to reveal the usernames behind the client
>connections I'm making, so I use nullidentd. It's very simplistic; it
>just returns a constant string for all ident requests. (It doesn't
>appear to be in ports; I simply
[EMAIL PROTECTED] wrote:
http://www.clock.org/~fair/opinion/identd.html
Thanks for giving a link that nicely illustrates my point about people
not understanding what ident does:
"The upshot of these assumptions is that when your system contacts the
identd server of a remote system, you can trust
On Tue, 28 Sep 2004 14:08:03 +0200, Daniel Hartmeier
<[EMAIL PROTECTED]> wrote:
> On Tue, Sep 28, 2004 at 04:46:40PM +0530, Siju George wrote:
>
> > But if I can get port 113 also in adaptive stealth mode like Zonealarm
> > did then it would be better isn't it?
>
> Not really. It can give a false
Rod.. Whitworth ([EMAIL PROTECTED]) wrote:
> On Tue, 28 Sep 2004 22:03:55 -0400, Greg Wooledge wrote:
> >Personally, I prefer not to reveal the usernames behind the client
> >connections I'm making, so I use nullidentd.
> What's better about that than making the flags -Hole on the inetd
> settings
On Fri, 1 Oct 2004 06:41:34 -0400, Greg Wooledge wrote:
>Rod.. Whitworth ([EMAIL PROTECTED]) wrote:
>> On Tue, 28 Sep 2004 22:03:55 -0400, Greg Wooledge wrote:
>> >Personally, I prefer not to reveal the usernames behind the client
>> >connections I'm making, so I use nullidentd.
>> What's better a
46 matches
Mail list logo