Re: iptables with a linux bridge

[Attila Nagy <bra@fsn.hu>]

Hello,

> One point you are missing is that it is possible using this kind of
> configuration to create a firewall where you cannot address any of
> it's external interfaces. So how can you do an intrusion attack on a
> firewall that you cannot address?
In theory it is possible. If you can use the packet filter for executing
arbitrary data (for example in an IP packet) you have the ability to get
root. Like with tcpdump. There were remote root exploits, but tcpdump
itself does not listens on any ports. This is the same, but with IP
addresses...

--------------------------------------------------------------------------
Attila Nagy                                    e-mail:  Attila.Nagy@fsn.hu
Budapest Polytechnic (BMF.HU)                   @work: +361 210 1415 (194)
H-1084 Budapest, Tavaszmezo u. 15-17.           cell.: +3630 306 6758