On Tue, 29 Aug 2006, Stephen Shirley wrote:
> Can you expand on why? I know i've been using iptables to do stateful
> firewalling for some years, and haven't had issues with it.
Because there is no need to statefully filter TCP, invalid TCP will
be denied by the TCP state machine - what exactly does it achieve to
try replicate that state machine in the middle?
You go from (as far as TCP state is concerned):
All you do is introduce ways for C to furk-up.
Next up, imagine that the line between A and B actually consists of
multiple paths, such that your firewalls must be replicated (again
this is in terms of where TCP state is kept):
Now you get the problem that C and D somehow must have their TCP
state-machines synchronised, or things don't work if a connection's
packets don't go through the same firewall that all previous packets
The idiotic answer at this point is, rather than go "sheesh, maybe
trying to recreate TCP state in the middle /wasn't/ such a good idea
after all?", is to try synchronise the TCP-firewall state between C
and D, noting that:
- you may not be do so any faster than A generates new state.
ie this solution is *full* of broken corner-cases by design.
The correct answer: Just filter out SYNs *statelessly*.
Keep the middle stupid, put the clever stuff at the edges, as Postel
et al intended.
Paul Jakma paul at clubi.iepaul at jakma.org Key ID: 64A2FF6A
The difference between a Miracle and a Fact is exactly the difference
between a mermaid and a seal.
-- Mark Twain
Maintained by the ILUG website team. The aim of Linux.ie is to
support and help commercial and private users of Linux in Ireland. You can
display ILUG news in your own webpages, read backend
information to find out how. Networking services kindly provided by HEAnet, server kindly donated by
Dell. Linux is a trademark of Linus Torvalds,
used with permission. No penguins were harmed in the production or maintenance
of this highly praised website. Looking for the
Indian Linux Users' Group? Try here. If you've read all this and aren't a lawyer: you should be!