Re: [gentoo-user] Is this firewall safe?

[Daniel Troeder <daniel@admin-box.com>]

[-- Attachment #1: Type: text/plain, Size: 1472 bytes --]

On Fri, 2009-04-24 at 18:40 +0000, Marco wrote:
> On Fri, Apr 24, 2009 at 5:23 PM, Daniel Troeder <daniel@admin-box.com> wrote:
> > On Fri, 2009-04-24 at 12:00 -0500, Chris Frederick wrote:
> [...]
> > While all that is correct, I would also consider it "bad network
> > behavior" (no offense intended).
> 
> So you consider my 'reject-with' settings to be good practice?
Yes :)

> > It feels like "security through obscurity". It may hamper the
> > well-working of a TCP/IP network, as that relies heavily on ICMP.
> 
> I was not really sure how to configure ICMP (ping) correctly. Any
> input appreciated!
That is really difficult, because ICMP is a family of lots of protocols,
from which ping is just one. Others are important too, like telling
routers/hosts about network congestion, and so on... I don't feel
competent enough to give directions. I do always allow ping, as this is
needed in a server environment to check for uptime, but your case may be
different.

> > Also: if you wish to scan (nmap) yourself to check your system
> > (configuration), you'll wish for REJECT instead of DROP :)
> 
> You mean as the default policy?
Yes, and also everywhere you use DROP. It's just, that you'll have to
wait less for timeouts, when connecting to a closed port.

If you decide to go with DROP, then you could make it globally
switchable in your script, to change between testing and production
environment/situation.

Bye,
Daniel


[-- Attachment #2: This is a digitally signed message part --]
[-- Type: application/pgp-signature, Size: 198 bytes --]