Subject: Re: tis on rh linux 6.1

From: Blair Lowe <[email-masked]>
Date: Mon, 21 Feb 2000 06:13:18 -0700

[To be removed from this list send the message "unsubscribe fwtk-users" in the
BODY of a mail message to [email-masked].]

Hi,

At 21:04 +0530 1999/11/25, Sachin Dole wrote:
>firewalls require that ipv4 packet forwarding be disabled... i dont know

Why?

>whether the rhl 6.1 (free distribution) installation is with or without
>packet forwarding... if it is .... how do i disable it in the kernel ...
>ie how do i recompile the kernel... ???
>
>the contents of /proc/sys/net/ipv4/ip_forward are just a "0"... does it
>mean ip forwarding is disabled by default???

Yes. Turn it on with "cat 1 > /proc/sys/net/ipv4/ip_forward".

Reconfiguring the Kernel is NOT necessary.

Blair.
Computer Engineering Inc.
http://www.compeng.net
Phone: 780 499 5687 (9 - 5 MST)
Fax:   780 435 0693 (24 Hours)

---

From: Rick Murphy <[email-masked]>
Date: Mon, 21 Feb 2000 14:17:06 -0500

>>firewalls require that ipv4 packet forwarding be disabled... i dont know

Because it's a *firewall*, not a router. If you enable forwarding, then I 
just route around your firewall software. (Unless you've got something else 
running that makes routing decisions that requires ipforwarding to be 
enabled. Really bad idea, that - anything that goes wrong with your 
ipchains/etc. means you're wide open.)
         -Rick

---

From: Blair Lowe <[email-masked]>
Date: Mon, 21 Feb 2000 13:55:37 -0700

Thanks Rick,

But I am still curious:

So if you use ipchains (correctly), what is wrong with a 
router[ipchains]/firewall[fwtk] config. I thought that this was a 
standard configuration? The LINUX Firewall HOWTO recommends it in 
fact.

I suppose you could screw up your netperm-table config too, so what's 
the difference?

Blair.

At 14:17 -0500 2000/02/21, Rick Murphy wrote:
>Because it's a *firewall*, not a router. If you enable forwarding, 
>then I just route around your firewall software. (Unless you've got 
>something else running that makes routing decisions that requires 
>ipforwarding to be enabled. Really bad idea, that - anything that 
>goes wrong with your ipchains/etc. means you're wide open.)
>         -Rick

---

From: Rick Murphy <[email-masked]>
Date: Mon, 21 Feb 2000 16:06:03 -0500

At 01:55 PM 2/21/00 -0700, Blair Lowe wrote:
>router[ipchains]/firewall[fwtk] config. I thought that this was a standard 
>configuration? The LINUX Firewall HOWTO recommends it in fact.

Right. As long as you don't enable ip forwarding if there's nothing 
limiting what gets forwarded. Does ipchains actually require ip forwarding 
to be on?

>I suppose you could screw up your netperm-table config too, so what's the 
>difference?
Enabling IP forwarding allows anyone to bypass your firewall entirely - 
that's a pretty heavy consequence for one problem :-)
         -Rick