Re: Firewall-Wizards Digest V1 #311

[Chris Brenton <cbrenton () sover net>]

Ryan Russell wrote:
> Proxies can't do this without an extra shim of some sort,

Why not simply check the data field for the SR tag? A real proxy should
be unable to forward traffic (source routed or not) without proxy
intervention.

> FW-1 doesn't do it.. 

Actually, it does. It has dropped SR by default since 2.1b or so. I
remember having to apply the patch. ;)

> Besides, you want to be able to configure that off
> in the OS, as another item on your hardening list to make
> it fail closed, or as closed as possible.

Agreed. Common practice is to remove SR support at the OS level when
ever possible.

Cheers,
Chris
-- 
**************************************
cbrenton () sover net

* Multiprotocol Network Design & Troubleshooting
http://www.amazon.com/exec/obidos/ASIN/0782120822/geekspeaknet
* Mastering Network Security
http://www.amazon.com/exec/obidos/ASIN/0782123430/geekspeaknet