Port 25 filters - how many here deploy them bidirectionally?
Todd Vierling
tv at duh.org
Mon Jan 10 16:08:05 UTC 2005
On Sun, 9 Jan 2005, Suresh Ramasubramanian wrote:
> Applying port 25 filters both ways (inbound and outbound to your
> dialup pool, instead of just outbound port 25 filtering) would help in
> such a situation.
It's good to clarify that this "bidirectional" filtering does not mean
filtering inbound to port 25 on the dialup box, but rather filtering inbound
*FROM* port 25 to the dialup box on any port (after all, you want to block
the 3WHS SYNACK and the subsequent in-stream ACKs). This is a common, but
critical, mistake.
--
-- Todd Vierling <tv at duh.org> <tv at pobox.com>
More information about the NANOG
mailing list