ipfw/nated stateful rules example
Alex Zbyslaw
xfb52 at dial.pipex.com
Wed Jan 21 08:48:39 PST 2004
Micheal Patterson wrote:
> Whereas what I'm doing "Private LAN Keep-State > NAT > World" is not secure
> and would not be accepted by a security professional? How do you figure
> that either method is more or less secure than the other? If stateful is
> breached in either method, the underlying network is compromised. Sorry,
> it's late and I may be missing something but I just don't see it.
I haven't checked your specific example, but in theory is nothing wrong with
this at all. One of my examples works the same way. Packets you didn't ask
for don't get through. How much more security can you want? As for breaching
the dynamic rules you would, I think, have to spoof at least the target IP and
probably more, in which case any firewall could succumb.
Personally, I am filing away the various example for future use, and calling
this topic closed. Thanks to everyone who posted solutions. I for one am
grateful.
--Alex
More information about the freebsd-questions
mailing list