[76997] in North American Network Operators' Group
Re: Port 25 filters - how many here deploy them bidirectionally?
daemon@ATHENA.MIT.EDU (Todd Vierling)
Mon Jan 10 11:08:43 2005
Date: Mon, 10 Jan 2005 11:08:05 -0500 (EST)
From: Todd Vierling <tv@duh.org>
To: Suresh Ramasubramanian <ops.lists@gmail.com>
Cc: nanog@nanog.org
In-Reply-To: <bb0e440a0501090625648426df@mail.gmail.com>
Errors-To: owner-nanog-outgoing@merit.edu
On Sun, 9 Jan 2005, Suresh Ramasubramanian wrote:
> Applying port 25 filters both ways (inbound and outbound to your
> dialup pool, instead of just outbound port 25 filtering) would help in
> such a situation.
It's good to clarify that this "bidirectional" filtering does not mean
filtering inbound to port 25 on the dialup box, but rather filtering inbound
*FROM* port 25 to the dialup box on any port (after all, you want to block
the 3WHS SYNACK and the subsequent in-stream ACKs). This is a common, but
critical, mistake.
--
-- Todd Vierling <tv@duh.org> <tv@pobox.com>
