Re: ipfilter vs nintendo DS

--0-1968334281-1170046204=:94171
Content-Type: text/plain; charset=iso-8859-1
Content-Transfer-Encoding: 8bit

I'm sure> At a quick guess,
> it's prolly something along the lines of FTP... which means you either need
> some fairly large holes, you'll need to write a proxy module for IPF to
> support it (like the FTP and VPN proxies).

> Perhaps if you provide some traffic dumps (not content, just flows) someone
> might be able to help you.


I doubt it's worth the trouble. There is TCP traffic on 80, 443, and 29900 (?)
which starts out looking like regular web connections, then I start getting packets
back from the web site with flag AS, and if I make a case for those then
I get flags like AP, and after I finally let in anything to or from any of those
ports, some udp traffic gets into the act...

Windows PC's and Solaris workstations and servers do all the normal IP
things through my ipfilter setup
without those kinds of rules, so there is something different going on.

I can see why the colleges gave up. stateful inspection doesn't look likely
to encompass all these goings on. Better to set up an insecure wireless
router outside my firewall than compromise the firewall. Perhaps somebody
more motivated than I will figure out a proxy.

Here are some examples of rules that seem to suffice as additions to the
normal keep-state rules for ports 80 and 443; 10.0.2.0 is the internal network.

pass in log quick proto tcp from any port = 80 to 10.0.2.0/24 port > 1023 group
100
pass out log quick proto tcp from any port = 80 to 10.0.2.0/24 port > 1023 group 151
pass in log quick proto tcp from 10.0.2.0/24 port > 1023 to any port = 80 group
101
pass out log quick proto tcp from 10.0.2.0/24 port > 1023 to any port = 80 group 150
pass in log quick proto tcp from any port = 443 to 10.0.2.0/24 port > 1023 group 100
pass out log quick proto tcp from any port = 443 to 10.0.2.0/24 port > 1023 group 151
pass in log quick proto tcp from 10.0.2.0/24 port > 1023 to any port = 443 group 101
pass out log quick proto tcp from 10.0.2.0/24 port > 1023 to any port = 443 group 150
pass in log quick proto tcp from any port = 29900 to 10.0.2.0/24 port > 1023 group 100
pass out log quick proto tcp from any port = 29900 to 10.0.2.0/24 port > 1023 group 151
pass in log quick proto tcp from 10.0.2.0/24 port > 1023 to any port = 29900 group 101
pass out log quick proto tcp from 10.0.2.0/24 port > 1023 to any port = 29900 group 150

The udp transactions seem to have gone away for the time being.


--0-1968334281-1170046204=:94171
Content-Type: text/html; charset=iso-8859-1
Content-Transfer-Encoding: 8bit

I'm sure&gt; At a quick guess,<br>&gt; it's prolly something along the lines of FTP... which means you either need<br>&gt; some fairly large holes, you'll need to write a proxy module for IPF to<br>&gt; support it (like the FTP and VPN proxies).<br><br>&gt; Perhaps if you provide some traffic dumps (not content, just flows) someone<br>&gt; might be able to help you.<br><br><br>I doubt it's worth the trouble.&nbsp;&nbsp;&nbsp; There is TCP traffic on 80, 443, and 29900 (?)<br>which starts out looking like regular web connections, then I start getting packets<br>back from the web site with flag AS, and if I make a case for those then<br>I get flags like AP, and after I finally let in anything to or from any of those<br>ports, some udp traffic gets into the act...<br><br>Windows PC's and Solaris workstations and servers do all the normal IP<br>things through my ipfilter setup<br>without those kinds of rules, so there is something different going on.<br><br>I can see why the
colleges gave up.&nbsp;&nbsp;&nbsp; stateful inspection doesn't look likely<br>to encompass all these goings on.&nbsp;&nbsp;&nbsp; Better to set up an insecure wireless<br>router outside my firewall than compromise the firewall.&nbsp;&nbsp;&nbsp; Perhaps somebody<br>more motivated than I will figure out a proxy.<br><br>Here are some examples of rules that seem to suffice as additions to the<br>normal keep-state rules for ports 80 and 443; 10.0.2.0 is the internal network.<br><br>pass in log quick proto tcp from any port = 80 to 10.0.2.0/24 port &gt; 1023 group<br>100<br>pass out log quick proto tcp from any port = 80 to 10.0.2.0/24 port &gt; 1023 group 151<br>pass in log quick proto tcp from 10.0.2.0/24 port &gt; 1023 to any port = 80 group<br>101<br>pass out log quick proto tcp from&nbsp; 10.0.2.0/24 port &gt; 1023 to any port = 80 group 150<br>pass in log quick proto tcp from any port = 443 to 10.0.2.0/24 port &gt; 1023 group 100<br>pass out log quick proto tcp from any
port = 443 to 10.0.2.0/24 port &gt; 1023 group 151<br>pass in log quick proto tcp from 10.0.2.0/24 port &gt; 1023 to any port = 443 group 101<br>pass out log quick proto tcp from&nbsp; 10.0.2.0/24 port &gt; 1023 to any port = 443 group 150<br>pass in log quick proto tcp from any port = 29900 to 10.0.2.0/24 port &gt; 1023 group 100<br>pass out log quick proto tcp from any port = 29900 to 10.0.2.0/24 port &gt; 1023 group 151<br>pass in log quick proto tcp from 10.0.2.0/24 port &gt; 1023 to any port = 29900 group 101<br>pass out log quick proto tcp from&nbsp; 10.0.2.0/24 port &gt; 1023 to any port = 29900 group 150<br><br>The udp transactions seem to have gone away for the time being.<br><br>
--0-1968334281-1170046204=:94171--