Re: newnotsyn question

Farkas Levente
Thu, 30 Dec 2004 16:44:51 -0000

Tom Eastep wrote:
> On Wed, 2004-12-29 at 15:39 -0800, Jack Coates wrote:
>
>
>>>If you don''t like the messages then don''t use
NEWNOTSYN=No. In a perfect
>>>network, NEWNOTSYN=No is a reasonable idea; alas, the Internet is
far
>>>from perfect. I offer NEWNOTSYN=No because people read books about
>>>firewalling and think that they have to have it; once they see it in
>>>action, they usually change their mind.
>>>
>>>-Tom
>>
>>sensible enough. Back when I was much deeper into firewalls it could be
>>done reasonably well on Check Point, but even then they''d break
it with
>>every patch as often as not.
>
>
> I played with this for quite a while -- I could get pretty reasonable
> behavior but at a cost if taking most of the teeth out of NEWNOTSYN=Yes.
> I concluded that most of the benefits of NEWNOTSYN=Yes could be achieved
> with much less impact using the ''tcpflags'' interface
option.

i don''t think so. the truth is that you have to play a lot with it to
work as desired. we got a bit complicated network the firewal has 5
ethernet interface, about a hundred of openvpn clients, internal routers
in the lan and more external zones. but after you able to use
NEWNOTSYN=No, you probably has a much better understanding of your own
network, may be after a bit redesing using different subnets and default
routes around you router, but in a simple case NEWNOTSYN=No usualy not a
problem in a more complex case you probably don''t understand all packet
path in advance (it''s turn out that something is not working), but
after
everything is working it''s a good tool.
may be there are same rare extrame network setup when it''s not usable,
but imho most case it''s a good think.
but that''s just my 2c:-)

--
   Levente                               "Si vis pacem para bellum!"