> On Mon, 9 Dec 1996 patrick@value.net wrote:
>
> > > But those type of filters should be put on your internet link so all of
> > > your network - dialup users and servers - are protected. You wouldn't
> > > want to put them on slip/ppp links would you?
> >
> > Correct.
> >
>
> Actually, you may want filters on BOTH. To be a good net citizen you
> should not only protect your servers and users from the internet, but
> you should also protect your servers and the internet from your users.
> (This is actually recommended by CERT in the anti-spoofing and SYN
> attack advisories and recommendations)
It is unecessary to place a filter on each individual ppp or slip link, if
you are filtering the internet link. Anything with a source address other
than the networks you have permitted, will prevented from being propagated
to the rest of the internet. Also having filters on the incoming filter to
prevent RFC 1597 addresses from entering your network are desireable.
> Hackers have a provider somewhere and I bet systems that have been
> attacked wished that the hacker's provider had thought to put filters
> on their dialup ports. Its alot easier to detect the source of an
> intrusion if you can stop and/or log the attempt at the source.
These addresses are already provided from what I have seen. Also there is
no "intrusion" if the attacker cannot implement his attack.
> Its a choice that needs to be made (performance vs. security) individually
> by each provider. Besides, some PPP connections are another provider
> whose customers you may not have direct control over.
This would depend on your network topology. Given our topology I can find
no reason to implement filters as you suggest. I do see where this would
be applicble if you were handing out subnets for full time customers and
such.
/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\
Patrick Greenwell (510) 943-5769 voice
Systems Administrator (510) 210-2000 modem
Value Net, Inc. (510) 943-1708 fax
\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/