On Tuesday 01 March 2005 15:50, Andre Tomt wrote:

quoted

Remember what my issue is:  
- I have a very tight firewall,
- I ping6 out,
- The firewall blocks the reply back, because the connection is stateless!

Never, ever, filter ICMP. Or at least be extremely careful doing so. You 
may end up breaking things like PMTU and error notification mechanisms.

Care to propose some rules?  Maybe not.

 

Also on a per-system basis I tend to prefer to secure services rather 
than firewall them; by for example just shutting them off/uninstalling 
them if not used, binding to localhost, use tcpwrappers.. that sort of 
thing.

Of course.  This is implicit.  But closing everything is best, to avert investigative activity.

Carl Cook