Thread: Hey all you firewall creators -- Let's talk

on subject of linux firewalls, there seems lot of discussion opening or allowing ports, lot of other finer nuances seemed missed.

see code floating around internet such following, commonly added ip start scrips:

echo "1" > /proc/sys/net/ipv4/icmp_ignore_bogus_error_responses
echo "1" > /proc/sys/net/ipv4/conf/all/log_martians
echo "2" > /proc/sys/net/ipv4/conf/all/rp_filter
echo "30" > /proc/sys/net/ipv4/tcp_fin_timeout
echo "2400" > /proc/sys/net/ipv4/tcp_keepalive_time
echo "0" > /proc/sys/net/ipv4/tcp_window_scaling
echo "0" > /proc/sys/net/ipv4/tcp_sack
echo "1" > /proc/sys/net/ipv4/tcp_syncookies
echo "0" > /proc/sys/net/ipv4/tcp_timestamps
echo "0" > /proc/sys/net/ipv4/conf/all/accept_source_route
echo "0" > /proc/sys/net/ipv4/conf/all/send_redirects

these kernel modifications effective, , there others should added firewall startup script?

posted kevdog

on subject of linux firewalls, there seems lot of discussion opening or allowing ports, lot of other finer nuances seemed missed.

see code floating around internet such following, commonly added ip start scrips:

echo "1" > /proc/sys/net/ipv4/icmp_ignore_bogus_error_responses
echo "1" > /proc/sys/net/ipv4/conf/all/log_martians
echo "2" > /proc/sys/net/ipv4/conf/all/rp_filter
echo "30" > /proc/sys/net/ipv4/tcp_fin_timeout
echo "2400" > /proc/sys/net/ipv4/tcp_keepalive_time
echo "0" > /proc/sys/net/ipv4/tcp_window_scaling
echo "0" > /proc/sys/net/ipv4/tcp_sack
echo "1" > /proc/sys/net/ipv4/tcp_syncookies
echo "0" > /proc/sys/net/ipv4/tcp_timestamps
echo "0" > /proc/sys/net/ipv4/conf/all/accept_source_route
echo "0" > /proc/sys/net/ipv4/conf/all/send_redirects

these kernel modifications effective, , there others should added firewall startup script?

these kernel tuneables , can effective depending on desired result. there few in there performance opposed security enhancements , think depend heavily on type of traffic you're expecting see. system security point of view ones feel important following

code:

echo "1" > /proc/sys/net/ipv4/icmp_ignore_bogus_error_responses echo "1" > /proc/sys/net/ipv4/conf/all/log_martians echo "2" > /proc/sys/net/ipv4/conf/all/rp_filter echo "1" > /proc/sys/net/ipv4/tcp_syncookies echo "0" > /proc/sys/net/ipv4/conf/all/accept_source_route echo "0" > /proc/sys/net/ipv4/conf/all/send_redirects

as these tuneables focus on either logging or deterring traffic used in malicious nature.

hope helps

Forum The Ubuntu Forum Community Ubuntu Specialised Support Security [ubuntu] Hey all you firewall creators -- Let's talk

Ubuntu