Re: [PATCH v2] add stealth mode

2015-07-07 10:07 GMT+02:00 Hannes Frederic Sowa [off-list ref]:

On Mon, Jul 6, 2015, at 21:44, Matteo Croce wrote:

quoted

2015-07-06 12:49 GMT+02:00  [off-list ref]:

quoted

On Thu, 02 Jul 2015 10:56:01 +0200, Matteo Croce said:

quoted

Add option to disable any reply not related to a listening socket,
like RST/ACK for TCP and ICMP Port-Unreachable for UDP.
Also disables ICMP replies to echo request and timestamp.
The stealth mode can be enabled selectively for a single interface.

A few notes.....

1) Do you have an actual use case where an iptables '-j DROP' isn't usable?

If you mean using a default DROP policy and allowing only the traffic
do you want,
then the use case is where the port can change at runtime and you may not
want
to update the firewall every time

Can't you use socket match in netfilter to accomplish exactly that?

You mean the owner --uid match?
Yes  sort of, but my was a different goal, I want just to disable any
kind of reply from a specific interface (usually WAN) unless there is
a listening socket, to mitigate port scanning and flood attacks
without having a firewall.

Obviously you can do it with a firewall,
but why do we have /proc/sys/net/ipv4/icmp_echo_ignore_all when we can
drop ICMP echoes?

-- 
Matteo Croce
OpenWrt Developer