[Sheflug] Re: Iptables

["Dawson, Alan" <xxxxx [at] xxxxxxxxxxxxxxxxxx>]

>
>
>    Baz> iptables -A FORWARD -i eth0 -o ppp0 -p tcp \
>    Baz>          -s 192.168.1.1/24 -d mail.mailserver.co.uk \
>    Baz>         --dport 110 -m state --state NEW,RELATED,ESTABLISHED \
>    Baz>          -j ACCEPT
>
>It's just occurred to me:

>Watch out for allowing new connections (--state NEW or --syn) if you
>haven't specified both in- and out- interfaces.
>Might be worth checking with nmap and/or telnet $pop_num.
>
>Do have a suitable policy or other rules further up the chain to block
>new connections from -i ppp0 or -s 0.0.0.0/0 ?
>

As a follower of this thread with interest I wonder if you could clarify
this last point...

As Richard is using a private non routable address range for his internal
LAN - 192.168.1.0/24 - I imagine it is possible to produce packets with
source 192.168.1.x and fire them them at his external ip - whatever ppp0 has
bound to it - from the internet, but as i understand the situation
impossible to gain a reply to them, as his machines would not route their
reply's back to the attacker.  

More simply put does his use of private ip range and masquerading not
protect him ..?

Alan Dawson  
___________________________________________________________________

Sheffield Linux User's Group -
http://www.sheflug.co.uk/mailfaq.html

  GNU the choice of a complete generation.