SYSTEM WARNING: 'date_default_timezone_get(): It is not safe to rely on the system's timezone settings. You are *required* to use the date.timezone setting or the date_default_timezone_set() function. In case you used any of those methods and you are still getting this warning, you most likely misspelled the timezone identifier. We selected the timezone 'UTC' for now, but please set date.timezone to select your timezone.' in '/usr/share/mantis/www/core.php' line 264

0001769: add a default rule to LOG-drop ips on wrong interface ("spoofing") - MantisBT

Endian Issue Tracker

Please see now our new Bugtracker system: JIRA

View Issue Details [ Jump to Notes ]

[ Issue History ] [ Print ]

Project

Category

View Status

Date Submitted

Last Update

0001769

Endian Firewall

Firewall (iptables)

public

2009-04-13 13:39

2009-06-10 11:05

Reporter

mike-f

Assigned To

Priority

normal

Severity

feature

Reproducibility

always

Status

new

Resolution

open

Platform

OS Version

Product Version

2.2-rc3

Target Version

Fixed in Version

Summary

0001769: add a default rule to LOG-drop ips on wrong interface ("spoofing")

Description

we want to see if somebody is spoofing internal ips

we read all ips on our interfaces (green, orange, blue)
afterwards we drop & LOG these packets:

i.e.
green 192.168.1.0/24
orange 10.0.0.0/24
blue 172.16.0.0/12

we log-drop:
on red 192.168.1.0/24 10.0.0.0/24 172.16.0.0/12
(eth1 is our RED)
-i eth1 -s 192.168.1.0/24 -j DROP
-i eth1 -s 10.0.0.0/24 -j DROP
-i eth1 -s 172.16.0.0/12 -j DROP

same for:
on green 10.0.0.0/24 172.16.0.0/12
on orange 192.168.1.0/24 172.16.0.0/12
on blue 192.168.1.0/24 10.0.0.0/24

Additional Information

these packets's won't be routed - but we want them to be seen in the logs
as these are possible attacks or at least errors in cabling

gets more complex when having more ips on one single IF

Issue History
Date Modified	Username	Field	Change
2009-04-13 13:39	mike-f	New Issue
2009-04-13 13:39	mike-f	Assigned To	=> peter-endian
2009-06-10 11:05	peter-endian	Assigned To	peter-endian =>
2009-06-10 11:05	peter-endian	Severity	trivial => feature

Relationships

Notes
There are no notes attached to this issue.