Tell me more ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.
up vote 1 down vote favorite

The question is pretty simple: Does it make sense to filter packets inside a small sized LAN, so the DMZ machines can access the internal ones based on the TTL? I can control that no tunnel will be created from the internal LAN to the outside, but I'm not sure if the TTL value is reliable, or can be faked.

Thanks all!!

share|improve this question
Just what is it you're trying to prevent? – Michael Hampton Sep 20 '12 at 17:15
In our DMZ one of the servers is router for a shared network that uses the same address scheme. The ip of the router changes a lot, and I have to update the firewall configuration to allow the router, but not the systems in that shared network. – Gonzalo Alvarez Sep 20 '12 at 17:23
Then base the rules on the router's MAC address. – Jeff Ferland Sep 20 '12 at 18:02
I've spent some time trying to do some tests, and as you already pointed out in the comments of your answer, it seems more reasonable to filter by MAC. If you don't mind to add this last comment about MAC filtering to your answer I would consider it accepted. Thanks a lot! – Gonzalo Alvarez Sep 21 '12 at 5:55

1 Answer

up vote 5 down vote

This doesn't make sense to try implementing. Here's why:

  • TTL can be initially set to whatever the origin system feels like. This is how traceroute works, for example. Therefore, measuring TTL isn't very useful for anything except traceroute or preventing routing loops.
  • The point of separating the DMZ from other local networks is to keep compromises on the DMZ from affecting those local networks, particularly in the form of attacks launched from the now-compromised DMZ systems.
share|improve this answer
But, if I can't set the TTL value to a negative one, can I? so, if I limit the TTL number to two, that would limit all packets comming from outside the DMZ, right? Anyway, you are completly right about your second point. If the DMZ is compromized, everything is compromised... – Gonzalo Alvarez Sep 20 '12 at 17:28
1  
TTL counts downward. You would need to set the TTL on all your DMZ devices to the maximum of 255 and then reject anything that isn't 254. Then you'd have shot yourself in the foot by not using a reasonable TTL and abusing the purpose of the field. It is better to screen martian packets and other network addresses that aren't where they are expected to be at your router interfaces. – Jeff Ferland Sep 20 '12 at 17:36
Good point about the TTL counting downward. I completly forgot that. What I don't understand is why am I abusing the purpose of the field. If I can control the servers that belong to the DMZ and the firewall (so I can set the TTL for all packets in these systems), can't I control what is getting inside the internal network using this mechanism? Is just a matter of controlling packets from the shared network I am talking about... – Gonzalo Alvarez Sep 20 '12 at 17:45
I no longer understand what you're trying to argue. – Jeff Ferland Sep 20 '12 at 18:03
1  
@GonzaloAlvarez Just because you might be able to get something to work doesn't mean it's a good idea. Supportability, maintainability, and implementability are all important factors your completely ignoring in your pursuit of field abuse. What happens when you get hit by a bus, will your replacement be able to figure out your filtering? What happens when you forget how your filtering works? What happens if you get a device where you can't change the TTL for some reason? – Chris S♦ Sep 20 '12 at 18:11
show 2 more comments

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.