RE: IPtables and RIP

If you know the ip addresses of the legitimate RIP ICMP sources, then
configure
the firewall rulesets to just allow the ICMP packets from those sources
instead of the world.

You can throw Iptables into logging mode for RIP packets only (see MAN
iptables, etc)
and see the source IP addresses
of the current RIP sources that way. Validate them and add those specific
IP's as allowed
for RIP and ICMP and deny for anyone else.

remember Rule set order is important.


++> -----Original Message-----
++> From: [email protected]
++> [mailto:[email protected]]On Behalf Of Eric Koldeweij
++> Sent: Monday, March 31, 2003 4:54 AM
++> To: [email protected]
++> Subject: IPtables and RIP
++>
++>
++> Hello All,
++>
++> I encountered a little problem on a friend's server, maybe
++> one of you
++> can help me out?
++>
++> He wants to use RIP for more efficient routing, so I had to
++> patch my
++> firewall script which is running on his server. So far not
++> a problem.
++> RIP works and all. But to make it work I had to accept ICMP
++> redirect
++> (type 5) packets, because RIP uses it for rerouting
++> packets. Now this
++> I'm not happy about because ICMP type 5 messages can be
++> easily abused
++> for hacking/DOS purposes.
++>
++> Is there a way I can check with IPtables if an ICMP
++> redirect message is
++> legitimate? I did see in the log that there is extra
++> information about
++> the original RIP packet which caused the redirect.... Is
++> there a way I
++> can use that information? Can I let the connection tracker
++> handle it? If
++> so, how? (accepting "related" messages didn't seem to work)
++>
++> I looked on the Net for information as well as in my
++> firewall books, but
++> they just say don't enable it :(
++>
++> Anyone who can help me out?
++>
++> He's using iptables-1.2.5-3 and a 2.4.18-24.7.xcustom
++> kernel, just in
++> case someone needs that info.
++>
++> Tnx,
++> Eric.
++>
++>
++>
++> _______________________________________________
++> enigma-list mailing list
++> [email protected]
++> https://listman.redhat.com/mailman/listinfo/enigma-list
++>