| 1 |
On Monday 29 May 2006 11:14, Jonathan Chocron wrote: |
| 2 |
> Le Dimanche 28 Mai 2006 16:53, Dave S a écrit : |
| 3 |
> > Yep, same here. I was trying to lock down my router. By default it allows |
| 4 |
> > any outgoing packets and only allows incoming packets if they are related |
| 5 |
> > to the incoming packets. |
| 6 |
> > |
| 7 |
> > I was trying to lock down my outgoing packets so services such as Samba |
| 8 |
> > would not broadcast anything to the WAN. |
| 9 |
> > |
| 10 |
> > As such I defaulted outgoing to BLOCK and allowed only certain ports. |
| 11 |
> > |
| 12 |
> > However I then needed to allow ports between computers ie for Samba |
| 13 |
> > again. |
| 14 |
> > |
| 15 |
> > When I opened the port on the LAN between computers my router wanted at |
| 16 |
> > least one IP address for the WAN. I did not want to give it a real |
| 17 |
> > address so choose 0.0.0.0 |
| 18 |
> > |
| 19 |
> > I was really asking ... |
| 20 |
> > |
| 21 |
> > (a) Is it worthwhile setting up my router this way, or am I being |
| 22 |
> > paranoid |
| 23 |
> > |
| 24 |
> > :) |
| 25 |
> |
| 26 |
> I do not think it wise to setup your router that way. Here's a little of |
| 27 |
> theory. I apologize if you're familiar with it, but it is necessary for |
| 28 |
> latter development. |
| 29 |
> |
| 30 |
> When in a LAN, a packet will not reach the WAN unless you specify you want |
| 31 |
> it to, that includes broadcasts. |
| 32 |
> |
| 33 |
> An element of an IP address is a number between 0 and 254. 255 is used only |
| 34 |
> for broadcasting. |
| 35 |
> |
| 36 |
> Moreover, rsync and samba, and most daemons take as a paramater the address |
| 37 |
> or address range they can accept connections from. An incoming connection |
| 38 |
> from the WAN, could not connect to the daemon even if it wanted to. |
| 39 |
|
| 40 |
With you so far :) |
| 41 |
|
| 42 |
> |
| 43 |
> > (b) Is 0.0.0.0 and invalid IP address (I though it might be) because that |
| 44 |
> > is what i was looking for to trick my router to send nothing to the WAN |
| 45 |
> |
| 46 |
> An IP address is meaningful only in conjunction with a mask. 0.0.0.0 with |
| 47 |
> mask 255.255.255.255 means broadcast to every single IP address that |
| 48 |
> exists. Since the mask indicates between which boundaries the IP number can |
| 49 |
> vary (in this case every IP address item can vary between 0 and 254). |
| 50 |
> |
| 51 |
> As a conclusion, this is definitely not what you want to do ! ;-) |
| 52 |
|
| 53 |
Gulp :( |
| 54 |
|
| 55 |
> |
| 56 |
> So, taking as a hypothesis that you trust everyone on your LAN, here's what |
| 57 |
> you should do : |
| 58 |
> - Et the policy for incomiong connections to BLOCK. |
| 59 |
> - Unblock the services you actually need the net to access. Plus, in the |
| 60 |
> config file of the daemon, specify it should listen to 0.0.0.0 |
| 61 |
> - Allow traffic from your LAN to the WAN (again, if you trust everyone). |
| 62 |
> And set up each daemon to only listen to 192.168.0.1/24 (which means only |
| 63 |
> addresses that begin with 192.168.0). |
| 64 |
> - Set up daemons to broadcast on 192.168.0.255 |
| 65 |
> |
| 66 |
> I hope this was clear, I have hardly slept last night ! |
| 67 |
> |
| 68 |
|
| 69 |
That helps a lot, thank you for taking the time to explain. I will have a |
| 70 |
google so I understand netmasks & IPs a bit more :( |
| 71 |
|
| 72 |
> -- Jonathan |
| 73 |
> |
| 74 |
> PS : No need to apologize for the delay, I know even gentooists have lives |
| 75 |
> ;) |
| 76 |
|
| 77 |
Wish I was 247 Linux - have to pay the mortgage though ! |
| 78 |
|
| 79 |
Thanks once again |
| 80 |
|
| 81 |
Dave |
| 82 |
|
| 83 |
-- |
| 84 |
gentoo-user@g.o mailing list |
Archives