Subject: RE: tis on rh linux 6.1

From: "Drash, Jim [EESUS]" <[email-masked]>
Date: Mon, 21 Feb 2000 20:50:30 -0500

[To be removed from this list send the message "unsubscribe fwtk-users" in the
BODY of a mail message to [email-masked].]

Actually, having ip forwardng on and ipchains means nothing unless you mess
up the forwarding ruleset (and the input rules and the output rules). That
is true of everything in life.  You will have problems if you mess things
up.

-----Original Message-----
From: Rick Murphy [mailto:[email-masked]]
Sent: Monday, February 21, 2000 4:06 PM
To: Blair Lowe
Cc: [email-masked]
Subject: Re: tis on rh linux 6.1

[To be removed from this list send the message "unsubscribe fwtk-users" in
the
BODY of a mail message to [email-masked].]

At 01:55 PM 2/21/00 -0700, Blair Lowe wrote:
>Thanks Rick,
>
>But I am still curious:
>
>So if you use ipchains (correctly), what is wrong with a 
>router[ipchains]/firewall[fwtk] config. I thought that this was a standard 
>configuration? The LINUX Firewall HOWTO recommends it in fact.

Right. As long as you don't enable ip forwarding if there's nothing 
limiting what gets forwarded. Does ipchains actually require ip forwarding 
to be on?

>I suppose you could screw up your netperm-table config too, so what's the 
>difference?
Enabling IP forwarding allows anyone to bypass your firewall entirely - 
that's a pretty heavy consequence for one problem :-)
         -Rick