On Tue, 27 Jun 2000, Dermot Hanley wrote:
> A firewall with IP forwarding switched off! No such thing, sorry!
well, by default unless userspace says otherwise.
(maybe it doesn't exist, but it should!)
:)
> If you switch off IP forwarding you can soley use netfilter or IP
> tables or the turbopacket facilities of Linux 2.3/2.4 kernel for IDS
> purposes as they use hooks into the kernel from userland to manage the
> state table & extract packet data, but all the routing & forwarding
> and firewall rules lookups are done in kernel space.
>
That sounds along the lines of what i was thinking of: mechanism in
kernel, policy decisions (eg using state keeping) in userspace. is that
how it works?
How useable are these 2.4 features at the moment? esp wrt to the userspace
daemons, are they even implemented yet?
> If these were done in userland (hey yeah let's use MySql to manage the
> state table *grin*) and IP forwarding is switched off then you have
^^^
on?
> the tasty situation of when your userspace firewall dies, *all*
> packets get forwarded to wherever they desire. Not nice.
>
not nice. i agree completely.
> Regards,
> Dermot
>
--paulj
Maintained by the ILUG website team. The aim of Linux.ie is to
support and help commercial and private users of Linux in Ireland. You can
display ILUG news in your own webpages, read backend
information to find out how. Networking services kindly provided by HEAnet, server kindly donated by
Dell. Linux is a trademark of Linus Torvalds,
used with permission. No penguins were harmed in the production or maintenance
of this highly praised website. Looking for the
Indian Linux Users' Group? Try here. If you've read all this and aren't a lawyer: you should be!
