Subject: tn-gw problem

From: Mann Robert <[email-masked]>
Date: Thu, 6 Jan 2000 18:18:01 +1000

[To be removed from this list send the message "unsubscribe fwtk-users" in the
BODY of a mail message to [email-masked].]

Hopefully this isn't user error but...

Using fwtk 2.1 on RedHat 6.

I'm trying to stop internal users from telnetting back into the internal
network via the gateway...eg

tn-gw:	deny-hosts unknown
tn-gw:	permit-hosts *.somewhere.com -dest !*.somewhere.com -dest *

I would have expected this to allow all users in somewhere.com to telnet to
everywhere except back into their domain, but it appears to allow them to go
anywhere.  I've confirmed that if you change the -dest !*.<etc> to any
domain other than the source it behaves correctly.  Any suggestions?

Thanks in advance.

---

From: "Carlos A. Ferraro Cavallini" <[email-masked]>
Date: Fri, 7 Jan 2000 08:41:28 +0100 (W. Europe Standard Time)

On Thu, 6 Jan 2000, Mann Robert wrote:

MR> Hopefully this isn't user error but...

...it's a security flaw...

MR> Using fwtk 2.1 on RedHat 6.
MR> 
MR> I'm trying to stop internal users from telnetting back into
MR> the internal network via the gateway...eg

The firewall is no place for a telnet daemon nor client!
Simply remove them and use SSH instead.

Regards,
	/C

_____________________________________________________________
Carlos A. Ferraro Cavallini
R&D Software, Spotfire AB
http://www.spotfire.com/~carlos