Re: Controlling ports used by natd

From: Barney Wolff (barney_at_databus.com)
Date: 12/12/03

  • Next message: Eric W. Bates: "Re: ssh tunnels and Xvnc - (yes, I know... What? not again!?)" 
    Date: Fri, 12 Dec 2003 13:19:44 -0500
To: Brett Glass <brett@lariat.org>

    On Fri, Dec 12, 2003 at 10:41:50AM -0700, Brett Glass wrote:
    > At 01:35 AM 12/12/2003, Barney Wolff wrote:
    >
    > >Oops, sorry for the confusion. How fancy a change is up to you,
    > >but changing ALIAS_PORT_BASE and ALIAS_PORT_MASK (and _EVEN)
    > >would let you confine the port range without much work.
    >
    > The current algorithm works so long as the blocked ports have
    > numbers less than 32768. But there are now lots of Trojans and
    > worms that use higher ports, and admins may want to block them.
    > So, there ought to be a way to tell libalias "don't assign anything
    > in this set of ports" -- via a list or a bitmap.

    How is this problem confined to NAT? Seems to me that any system
    connecting to the Internet would have the same issue, if it's actually
    a problem at all.

    So if I were going to solve it (which I'm not) I would expose the kernel's
    "pick a high port" function, add hitlist capability, and have libalias use it. 

    -- 
Barney Wolff         http://www.databus.com/bwresume.pdf
I'm available by contract or FT, in the NYC metro area or via the 'Net.
_______________________________________________
freebsd-net@freebsd.org mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-net
To unsubscribe, send any mail to "freebsd-net-unsubscribe@freebsd.org"
  • Next message: Eric W. Bates: "Re: ssh tunnels and Xvnc - (yes, I know... What? not again!?)"

    Relevant Pages