Very Computer

by **newsv** » Tue, 11 May 1999 04:00:00

The Firewall HOWTO and some other sources that I've looked at emphasize that
you should turn IP forwarding off in firewalls and (I believe) IP
masquerading boxes as well. In principle I understand that you should turn
off all the services possible to secure a box. My question is, what
vulnerabilities does IP forwarding expose?

For instance suppose you have an IP masquerading box with two nics -- one
talking to a 192.168.x.y private network, and one with a public IP address.
I can see how maybe a cracker could come send some packets to the public
side of the masq box that appeared to come from an 192.168.x.y address...
but I can't see how that would do a cracker any good. And if I am guessing
right and this is how a cracker would exploit IP forwarding, then is there a
way to stipulate that packets from a 192.168.x.y address should be rejected
by the publicly accessible NIC?

Thanks in advance
Don

by **Raymonds Doetje** » Wed, 12 May 1999 04:00:00

The thread lies here:
When a hacker gets in to your so called "Bastion" host this can happen because
you allowed telnet logins from anywhere than the hacker can start software like
IP sniffers that check the ip traffic on you internal network (that is usally
masqed). ANd so grep passwords that are send un encrypted or data.

Or even worse, if you have mounting tools installed on your bastion host the
hacker can mount NFS or SMB sexports/shares and copy your files to his system
and perhaps sell the wanted data.

P.S. (I'm no hacker I only use my knowledge for good).

Raymond

> The Firewall HOWTO and some other sources that I've looked at emphasize that
> you should turn IP forwarding off in firewalls and (I believe) IP
> masquerading boxes as well. In principle I understand that you should turn
> off all the services possible to secure a box. My question is, what
> vulnerabilities does IP forwarding expose?

> For instance suppose you have an IP masquerading box with two nics -- one
> talking to a 192.168.x.y private network, and one with a public IP address.
> I can see how maybe a cracker could come send some packets to the public
> side of the masq box that appeared to come from an 192.168.x.y address...
> but I can't see how that would do a cracker any good. And if I am guessing
> right and this is how a cracker would exploit IP forwarding, then is there a
> way to stipulate that packets from a 192.168.x.y address should be rejected
> by the publicly accessible NIC?

> Thanks in advance
> Don

by **Paul Rusty Russel** » Wed, 12 May 1999 04:00:00

> The Firewall HOWTO and some other sources that I've looked at emphasize that
> you should turn IP forwarding off in firewalls and (I believe) IP
> masquerading boxes as well. In principle I understand that you should turn
> off all the services possible to secure a box. My question is, what
> vulnerabilities does IP forwarding expose?

To do masquerading, you need IP forwarding ON. No pass packet, no
masquerade.

Rusty.
--
Tridge, Raster, DaveM, Cort, maddog... Where will you be 9-11 July 1999?
http://www.linux.org.au/projects/calu

Very Computer

IP forwarding in firewalls and masquerade boxes

IP forwarding in firewalls and masquerade boxes

IP forwarding in firewalls and masquerade boxes

IP forwarding in firewalls and masquerade boxes