Re: newnotsyn question

Jack Coates
Wed, 29 Dec 2004 23:39:27 -0000

Tom Eastep wrote:
> On Wed, 2004-12-29 at 15:28 -0800, Jack Coates wrote:
>
>
>>I get a significant number of newnotsyn packet denials from existing,
>>valid connections. Most of these seem to be on port 80 and port 25, and
>>directionality doesn''t seem to matter (I run public web and
mail
>>services on the firewall).
>
>
> If you don''t like the messages then don''t use
NEWNOTSYN=No. In a perfect
> network, NEWNOTSYN=No is a reasonable idea; alas, the Internet is far
> from perfect. I offer NEWNOTSYN=No because people read books about
> firewalling and think that they have to have it; once they see it in
> action, they usually change their mind.
>
> -Tom

sensible enough. Back when I was much deeper into firewalls it could be
done reasonably well on Check Point, but even then they''d break it with
every patch as often as not.

thanks,
--
Jack at Monkeynoodle dot Org: It''s a Scientific Venture...
Riding the Emergency Third Rail Power Trip since 1996!