Michael L Torrie wrote:
Last night I asked about the difference between DROP and REJECT. I found that if you use the REJECT target with a --reject-with tcp-reset argument, then your firewalls looks as if the filtered ports were never open in the first place (and compliant with the RFCs for IP). There are other forms of REJECT, such as host not reachable, etc. These are all quite useful. I personally take the position that dropping packets silently does not buy anything. Slowing down a port scan does nothing but say "I'm here and this port is definitely firewalled." This opens you up to DoS attacks (simplistic ones) that could fill up your logs, etc. In many cases, I would prefer to reject with tcp-reset, rather than silently drop. There are many other cases where DROP is more appropriate, however.
I am also annoyed that it's become common practice to block pings. This makes tracking down network problems very difficult. I have a policy on my local network that users must allow ping. XP SP2 blocks ping by default which really irritates me.
This may sound odd to some, but on my Linode server, I run no firewall at all and it sits out on the big bad internet. This is because every port that's open on it I want to be open, and the firewall would be quite pointless. Of course I've taken great pains to turn off services and make sure things like PostgreSQL and MySQL only bind to localhost or use unix sockets. Firewalls (the iptables kind) do nothing to protect services you want open anyway.
In the case of a network gateway, however, a firewall is essential.
Food for thought.
Michael
Michael, Good information. If you don't mind I'll add this to my notes. -Mike Wilson
____________________
BYU Unix Users Group http://uug.byu.edu/ ___________________________________________________________________
List Info: http://uug.byu.edu/cgi-bin/mailman/listinfo/uug-list
