<?xml version="1.0" encoding="utf-8"?>
<rss version="2.0" xmlns:atom="http://www.w3.org/2005/Atom">
	<channel>
		<atom:link href="https://dev1galaxy.org/extern.php?action=feed&amp;tid=1621&amp;type=rss" rel="self" type="application/rss+xml" />
		<title><![CDATA[Dev1 Galaxy Forum / UFW Rules: Can anyone confirm this?]]></title>
		<link>https://dev1galaxy.org/viewtopic.php?id=1621</link>
		<description><![CDATA[The most recent posts in UFW Rules: Can anyone confirm this?.]]></description>
		<lastBuildDate>Mon, 02 Oct 2017 21:20:17 +0000</lastBuildDate>
		<generator>FluxBB</generator>
		<item>
			<title><![CDATA[Re: UFW Rules: Can anyone confirm this?]]></title>
			<link>https://dev1galaxy.org/viewtopic.php?pid=5273#p5273</link>
			<description><![CDATA[<p>To be clear, ICMP is a <span class="bbu">protocol</span> and not a port; it&#039;s the Internet Control Message Protocol, whereby routers may exchange meta-data about IP level connectivity. There are several networking protocols to consider, both within the IP class (such as in particular TCP and UDP), and outside the IP class (in a range of varying obscurity).</p><p>As said before, there is no such thing as &quot;invisible&quot; on the Internet, short of not being connected at all. But there is a gray scale of &quot;protection layers&quot; of setting blockages for certain network traffic, depending on how you want your host to handle it. I&#039;.e., like the rules you showed on top, which indeed tells the host to drop certain incoming ICMP packets, rather than deliver them to their normal handling (by the kernel). I think you&#039;d do well in dropping IGMP as well, and then consider blocks for TCP and UDP messaging, which offer the majority of intentionally harmful networking.</p>]]></description>
			<author><![CDATA[dummy@example.com (ralph.ronnquist)]]></author>
			<pubDate>Mon, 02 Oct 2017 21:20:17 +0000</pubDate>
			<guid>https://dev1galaxy.org/viewtopic.php?pid=5273#p5273</guid>
		</item>
		<item>
			<title><![CDATA[Re: UFW Rules: Can anyone confirm this?]]></title>
			<link>https://dev1galaxy.org/viewtopic.php?pid=5270#p5270</link>
			<description><![CDATA[<p>Those specific rules, to my knowledge, block the ICMP port (something that, strangely, you can&#039;t block using the graphical front end of GUFW), which means your computer would be invisible in the sense of replying to pings, but that&#039;s only on the ICMP port.</p><p>If your computer &#039;reaches out&#039; via some other port, then it won&#039;t be entirely invisible, likewise if there are any ports that are open or explicitly give rejection messages (as opposed to simply dropping them).</p><p>If you want to determine how &#039;quiet&#039; your machine is, from an external machine (there are some limited capacity sites that offer this) you will want to try to use nmap to do a full blown port scan coupled with an OS detection attempt on your given external IP.</p><p>If nmap detects any services, ports in use, or is able to guess it&#039;s OS (with reasonable accuracy), then it&#039;s not &#039;quiet&#039; (I use &#039;quiet&#039; to distinguish from &#039;invisible&#039; because nothing is truly invisible, even airgapped networks can be penetrated). Naturally, if you connect to any web service then that service knows you&#039;re active. Even if your system is &#039;quiet&#039; a Trojan or backdoor could still &#039;leak&#039; information out.</p><p>It&#039;s also worth noting that even if your own machine is &#039;quiet&#039;, your router might not be.</p><p>Regardless, it&#039;s a good idea to keep the ping reply &#039;quiet&#039; on a system, because part of avoiding an attack is not letting an attacker know there is something there to be attacked.</p>]]></description>
			<author><![CDATA[dummy@example.com (JoshuaFlynn)]]></author>
			<pubDate>Mon, 02 Oct 2017 12:37:46 +0000</pubDate>
			<guid>https://dev1galaxy.org/viewtopic.php?pid=5270#p5270</guid>
		</item>
		<item>
			<title><![CDATA[Re: UFW Rules: Can anyone confirm this?]]></title>
			<link>https://dev1galaxy.org/viewtopic.php?pid=5222#p5222</link>
			<description><![CDATA[<p>Thanks Racoton.</p>]]></description>
			<author><![CDATA[dummy@example.com (MiyoLinux)]]></author>
			<pubDate>Sat, 30 Sep 2017 00:46:43 +0000</pubDate>
			<guid>https://dev1galaxy.org/viewtopic.php?pid=5222#p5222</guid>
		</item>
		<item>
			<title><![CDATA[Re: UFW Rules: Can anyone confirm this?]]></title>
			<link>https://dev1galaxy.org/viewtopic.php?pid=5218#p5218</link>
			<description><![CDATA[<p>&quot;Completely invisible&quot; there is nothing connected to a network. If you use those rules and for example do not block arp queries, your machine will not be &quot;invisible&quot; to the curious and resourceful minds.</p>]]></description>
			<author><![CDATA[dummy@example.com (Racoton)]]></author>
			<pubDate>Fri, 29 Sep 2017 21:34:53 +0000</pubDate>
			<guid>https://dev1galaxy.org/viewtopic.php?pid=5218#p5218</guid>
		</item>
		<item>
			<title><![CDATA[UFW Rules: Can anyone confirm this?]]></title>
			<link>https://dev1galaxy.org/viewtopic.php?pid=5212#p5212</link>
			<description><![CDATA[<p>I read that someone entered these rules for UFW, and it resulted in their computer being completely invisible on the internet. I&#039;m wondering if someone more familiar with UFW rules (than I am) can confirm this. Here are the <span class="bbu">before.rules</span> that they listed...</p><div class="codebox"><pre><code>    -A ufw-before-input -p icmp --icmp-type destination-unreachable -j DROP
    -A ufw-before-input -p icmp --icmp-type source-quench -j DROP
    -A ufw-before-input -p icmp --icmp-type time-exceeded -j DROP
    -A ufw-before-input -p icmp --icmp-type parameter-problem -j DROP
    -A ufw-before-input -p icmp --icmp-type echo-request -j DROP</code></pre></div>]]></description>
			<author><![CDATA[dummy@example.com (MiyoLinux)]]></author>
			<pubDate>Fri, 29 Sep 2017 14:43:02 +0000</pubDate>
			<guid>https://dev1galaxy.org/viewtopic.php?pid=5212#p5212</guid>
		</item>
	</channel>
</rss>
