SYSTEM WARNING: 'date_default_timezone_get(): It is not safe to rely on the system's timezone settings. You are *required* to use the date.timezone setting or the date_default_timezone_set() function. In case you used any of those methods and you are still getting this warning, you most likely misspelled the timezone identifier. We selected the timezone 'UTC' for now, but please set date.timezone to select your timezone.' in '/usr/share/mantis/www/core.php' line 264

0001769: add a default rule to LOG-drop ips on wrong interface ("spoofing") - MantisBT
MantisBT - Endian Firewall
View Issue Details
0001769Endian FirewallFirewall (iptables)public2009-04-13 13:392009-06-10 11:05
mike-f 
 
normalfeaturealways
newopen 
2.2-rc3 
 
0001769: add a default rule to LOG-drop ips on wrong interface ("spoofing")
we want to see if somebody is spoofing internal ips

we read all ips on our interfaces (green, orange, blue)
afterwards we drop & LOG these packets:

i.e.
green 192.168.1.0/24
orange 10.0.0.0/24
blue 172.16.0.0/12

we log-drop:
on red 192.168.1.0/24 10.0.0.0/24 172.16.0.0/12
(eth1 is our RED)
-i eth1 -s 192.168.1.0/24 -j DROP
-i eth1 -s 10.0.0.0/24 -j DROP
-i eth1 -s 172.16.0.0/12 -j DROP

same for:
on green 10.0.0.0/24 172.16.0.0/12
on orange 192.168.1.0/24 172.16.0.0/12
on blue 192.168.1.0/24 10.0.0.0/24
these packets's won't be routed - but we want them to be seen in the logs
as these are possible attacks or at least errors in cabling

gets more complex when having more ips on one single IF
No tags attached.
Issue History
2009-04-13 13:39mike-fNew Issue
2009-04-13 13:39mike-fAssigned To => peter-endian
2009-06-10 11:05peter-endianAssigned Topeter-endian =>
2009-06-10 11:05peter-endianSeveritytrivial => feature

There are no notes attached to this issue.