Re: pf blocking nfs

From: Chuck Swiger (cswiger_at_mac.com)
Date: 11/30/05

  • Next message: cpghost: "Zoran ZR36067 (Pinnacle DC10+) for 6.0-STABLE?" 
    Date: Tue, 29 Nov 2005 22:33:41 -0500
To: "Aaron P. Martinez" <ml@proficuous.com>

    Aaron P. Martinez wrote:
    [ ... ]
    > Actually my network looks like this:
    >
    > INT---firewall------internal router/firewall---------good lan
    > | |
    > | |---------insecure lan (windoze machines)
    > |
    > |----DMZ
    >
    > the good lan is the only one that does nfs, so the nfs doesn't actually
    > pass through the firewall, just connects to the internal router/firewall.
    > I am simply trying to avoid a worst case scenario (internal router gets
    > compromised) so trying to allow ONLY return packets. Is this unfeasable?

    I take it that your internal firewall box has three NICs, then?

    Normally, your firewall should not be doing anything else but security
    and would not be mounting NFS or depending on any other services on your
    network. If that is not possible, you should permit traffic through the
    interface on the "good LAN". 

    -- 
-Chuck
_______________________________________________
freebsd-questions@freebsd.org mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-questions
To unsubscribe, send any mail to "freebsd-questions-unsubscribe@freebsd.org"
  • Next message: cpghost: "Zoran ZR36067 (Pinnacle DC10+) for 6.0-STABLE?"

    Relevant Pages

    • Re: freebsd-net Digest, Vol 13, Issue 6
      ... you were just referring to the LAN, but remember that a firewall in the WAN ... your network performance and security can improve ... Your NFS and backend communication ... > server, equipped with a gazillion disk drives, all with RAID0+1, and simply ...
      (freebsd-net)
    • Re: Using multiple NICs
      ... one with the NFS server and one without the NFS server and a ... Lets say your NFS server is 192.168.1.100 and is thus on network ... You connect the machine with an IP of 192.168.2.199 to switch B ... two NICs, then what you want to do is bonding. ...
      (comp.os.linux.misc)
    • Re: secure nfs alternatives
      ... > for nfs, i wonder what else exists out there that has a better security ... your NFS network and become any user but not the root user on the server. ... AFS, and specifically, OpenAFS is the way to go. ... Other alternatives are Intermezzo, ARL, Coda. ...
      (comp.os.linux.security)
    • Re: GFS, whats remaining
      ... The shared storage access _is_ network access. ... be a TCP/IP network just like the one folks use for NFS (but carrying ... NFS access is because the block access network protocols are supposed to ...
      (Linux-Kernel)
    • Re: [PATCH 00/33] Swap over NFS -v14
      ... swap over NFS is a pretty rare case. ... NBD or swapping over NFS. ... sized allocations, ... One of the goals of my approach was to not rewrite the network subsystem ...
      (Linux-Kernel)