|
||||||||||
Indeed, when I allow IGMP, they will still end up in my logs. Looks like when "implicit logging (default rule)" is enabled m0n0wall ignores the non-log of the explicit rule. -Timothy sylikc wrote: >Timothy, > > > >>I now did uncheck "Log packets blocked by the default rule" and created >>a rule to block TCP/UDP on WAN with logging enabled. >>This kind of works but it's not a very clean sollution. Will I still be >>able to open ports on my WAN as I created a rule before to block everything? >> >> > >You can open ports on WAN as long as the rules appear before the >all-block rule. m0n0 goes through the rules in the order listed, so >as long as you move the allow rules up top then it should work. > > > > >>I did try to create a rule to block IGMP first (with no logging) as Fred >>mentioned, but the default rule would still log IGMP packets. >> >> > >Correct me if I'm wrong, because I can't recreate the situation you >describe here... How can the implicit default block rule (logged) for >IGMP packets that have been blocked by an explicit rule (without >logging) show up in the logs? AFAIK, once an explicit block rule has >been hit, m0n0 does everything that is requested there, including not >logging, then stops. Are you sure you don't have another block rule >above it or something that's logging? Or you accidentally selected >the wrong interface (or specified an IP) to block IGMP on? > > > > >>I could always allow IGMP, that way the packets wouldn't get logged, but >>can allowing IGMP be a security risk? >> >> > >If the above is true, where an explicit block rule that says DON'T LOG >ends up falling in your logs anyway, I can't see why an explicit allow >rule that says DON'T LOG wouldn't end up in your logs also... > >AFAIK in terms of security, IGMP packets are pretty harmless. They >are just probe/update packets for multicasting. I'm pretty sure m0n0 >just drops them. I'm not aware of any exploits that make use of IGMP. > Here's a link that describes what IGMP is/does: >http://www.et.put.poznan.pl/tcpip/igmp/igmp_intro.htm > > > >/sylikc > > > > > |