[5666] in bugtraq
ipfw workaround for syn-loop attack, FreeBSD 2.2.5-STABLE
daemon@ATHENA.MIT.EDU (Robert Watson)
Fri Nov 21 02:21:02 1997
Date: Thu, 20 Nov 1997 18:15:22 -0500
Reply-To: Robert Watson <robert@cyrus.watson.org>
From: Robert Watson <robert@CYRUS.WATSON.ORG>
X-To: freebsd-security@freebsd.org
To: BUGTRAQ@NETSPACE.ORG
Adding a rule for the interface denying packets from oneself appears to
defend against the new attack.
This rule worked:
03001 deny ip from 128.2.91.57 to 128.2.91.57 via ed0
Where 128.2.91.57 is the host's IP address on device ed0.
This presumably works on other versions of FreeBSD, and other systems with
ipfw/ipfirewall installed on them. As always, if you are not familiar
with ipfw and don't know how it works, don't use this unless you are on
the console the first time!
Adding this to rc.firewall on FreeBSD is also a good idea. Multi-homed
hosts require one entry per device, needless to say.
Robert N Watson
Junior, Logic+Computation, Carnegie Mellon University http://www.cmu.edu/
Network Administrator, SafePort Network Services http://www.safeport.com/
robert@fledge.watson.org rwatson@safeport.com http://www.watson.org/~robert/
