Re: Learning how-to pf "right"

--001a11339932f79a9e05160a306a
Content-Type: text/plain; charset=UTF-8

On Wed, May 13, 2015 at 10:29 PM, Karl O. Pinc <[email protected]> wrote:

> There is one more thing you can do to be a good neighbor.
> The following rule foils people who would use you to mount
> a sequence number spoofing attack on someone else.
> (You would play the role of "A" in rfc1948.)
>
>  block in on $ext_if proto tcp flags sa/sa return-rst


unless you're an Internet Service Provider, or you are
participating in some kind of peering arrangement, you
should not be accepting any unsolicited packets from
$ext_if, never mind forwarding them back out on $ext_if.

for a typical home or business gateway, this is a sensible
default to use:

    block in on $ext_if all

then follow that with pass rules for the specific traffic
you want to accept.

-ken

--001a11339932f79a9e05160a306a
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable

<div dir=3D"ltr"><div class=3D"gmail_extra"><div class=3D"gmail_quote">On W=
ed, May 13, 2015 at 10:29 PM, Karl O. Pinc <span dir=3D"ltr">&lt;<a href=3D=
"mailto:[email protected]" target=3D"_blank">[email protected]</a>&gt;</span> wrote:<=
br><blockquote class=3D"gmail_quote" style=3D"margin:0 0 0 .8ex;border-left=
:1px #ccc solid;padding-left:1ex">There is one more thing you can do to be =
a good neighbor.<br>
The following rule foils people who would use you to mount<br>
a sequence number spoofing attack on someone else.<br>
(You would play the role of &quot;A&quot; in rfc1948.)<br>
<br>
=C2=A0block in on $ext_if proto tcp flags sa/sa return-rst</blockquote><div=
><br></div><div>unless you&#39;re an Internet Service Provider, or you are<=
/div><div>participating in some kind of peering arrangement, you</div><div>=
should not be accepting any unsolicited packets from</div><div>$ext_if, nev=
er mind forwarding them back out on $ext_if.</div><div><br></div><div>for a=
 typical home or business gateway, this is a sensible</div><div>default to =
use:</div><div><br></div><div>=C2=A0 =C2=A0 block in on $ext_if all</div><d=
iv><br></div><div>then follow that with pass rules for the specific traffic=
</div><div>you want to accept.</div><div><br></div><div>-ken</div></div></d=
iv></div>

--001a11339932f79a9e05160a306a--