The UNIX and Linux Forums  

Go Back   The UNIX and Linux Forums > Special Forums > Security
.
google unix.com



Security Discuss UNIX and Linux computer and network security, cybersecurity, cyberattacks, IT security, CISSP, OWASP and more.

More UNIX and Linux Forum Topics You Might Find Helpful
Thread Thread Starter Forum Replies Last Post
FreeBSD IPFW Rules clarification please... DanUK Security 1 08-13-2008 07:39 PM
R-246: Multiple Vulnerabilities in Cisco IOS while Processing SSL Packets iBot Security Advisories (RSS) 0 12-24-2007 09:40 AM
Need help with IPFW.. Please... fundidor UNIX for Dummies Questions & Answers 2 10-10-2005 08:23 PM
Dynamic select with multiple word menu items domivv Shell Programming and Scripting 5 07-22-2004 09:52 AM
Redirecting outgoing packets Seraph IP Networking 1 08-08-2003 10:40 PM

Closed Thread
English Japanese Spanish French German Portuguese Italian Dutch Swedish Russian Norwegian Hungarian Hebrew Danish Bulgarian Greek Powered by Powered by Google
 
LinkBack Thread Tools Search this Thread Rating: Thread Rating: 1 votes, 5.00 average. Display Modes
  #1 (permalink)  
Old 08-03-2008
steffen steffen is offline
Registered User
  
 

Join Date: Aug 2008
Posts: 1
ipfw - dynamic rules and multiple IP addresses with outgoing packets

Here's the problem: Some email-service providers (like
Google) have more than one server and distribute the load such that, e.g. the incoming mail server imap.gmail.com is assigned to more than one IP-address.

With stateful rules, the ipfw firewall correctly allows outgoing packages to one of the IP-addresses of the mail server. However, packages to the same port but to a different IP-address are consistently rejected.

I suspect that following the establishment of the initial connection, dynamic rules tables will not match because of the inconsistent IP address, and therefore outgoing packages to the second IP-address are always denied.

Does anyone know a solution to this problem?
Many Thanks.
Here are the relevant parts of my rule set:
...

#allow packet through if it has previously been added to the dynamic rules table
ipfw -q add 0010 check-state

#allow out get & send email function
ipfw -q add 0040 allow tcp from any to any 993 out via $nic setup keep-state
...

And here's the log:
Aug 3 18:44:33 xxx Firewall[38]: 42 Accept TCP my.ip.address:50201 209.85.147.111:993 out via en1
Aug 3 18:44:33 xxx Firewall[38]: 70 Deny TCP my.ip.address:49866 209.85.199.109:993 out via en1
  #2 (permalink)  
Old 08-15-2008
amsct amsct is offline
Registered User
  
 

Join Date: Aug 2008
Location: Amsterdam, The Netherlands
Posts: 33
Usually, a mail client might resolve more then one IP for the same hostname, but it will connect to only one of those addresses for the duration of the session. So it shouldn't be a problem for your dynamic rules.
Your first log entry states rule 42 while in your ruleset rule 40 is the that should match.
do you use nat?
Closed Thread

Bookmarks

Tags
firewall, ipfw, security, stateful rules

Thread Tools Search this Thread
Search this Thread:

Advanced Search
Display Modes Rate This Thread
Rate This Thread:

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is On
HTML code is Off
Trackbacks are On
Pingbacks are On
Refbacks are On




All times are GMT -4. The time now is 06:58 PM.


Powered by: vBulletin, Copyright ©2000 - 2006, Jelsoft Enterprises Limited. Language Translations Powered by .
vBCredits v1.4 Copyright ©2007 - 2008, PixelFX Studios
The UNIX and Linux Forums Content Copyright ©1993-2009. All Rights Reserved.Ad Management by RedTyger

Content Relevant URLs by vBSEO 3.2.0