Gentoo Archives: gentoo-security

From: xyon <xyon@×××××××××××.com>
To: gentoo-security@l.g.o
Subject: Re: [gentoo-security] iptables window of opportunity at startup
Date: Tue, 07 Feb 2006 17:51:53
Message-Id: ME-1F6Wrg-0001Mt-V5@indigorobot.com
In Reply to: Re: [gentoo-security] iptables window of opportunity at startup by Francois Toussenel
I am coming into this conversation late, and I apologize if this is
already said, but:

When iptables/firewall 'stops', I have it drop all connections, so having
iptables stop before net.eth{0,1,etc} during shutdown isn't a problem.

Hope this helps


On Tue, February 7, 2006 12:16, Francois Toussenel wrote:
> On Sun, 5 Feb 2006 13:29:55 +0100 Tobias Klausmann > <klausman@××××××××××××.de> wrote: > >> Which *should* make iptables start before net.* (maybe except >> net.lo). And sure enough, the boot sequence is: > > This depends on the runlevels in which you have iptables and net.eth0. > Could you please post the output of the following command? > > # rc-update show | grep 'iptables\|net\.' > > By having iptables in boot and net.eth0 in default, iptables starts > before net.eth0, but it also stops before services and of course > net.eth0. Does somebody know a setting to avoid that? > > (I would add that one might want to never respond to pings, for > instance, so starting iptables between net.eth0 and services seems not > enough.) > > Regards, > > Francois > -- > gentoo-security@g.o mailing list > >
-- Steven McCoy Site Development/Manager IndigoRobot Services http://www.indigorobot.com mailto:stevenmccoy@×××××××××××.com -- gentoo-security@g.o mailing list