https://bugzilla.novell.com/show_bug.cgi?id=368534 User benji.weber@gmail.com added comment https://bugzilla.novell.com/show_bug.cgi?id=368534#c1 Benjamin Weber changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |benji.weber@gmail.com --- Comment #1 from Benjamin Weber 2008-03-09 14:19:33 MST --- Some notes - Replying to Ping seems to work out of the box for me, even with it set to no, perhaps that rule is just broken? - Ident is REJECTed by default already, so not everything is DROPed. - There are frequent bug reports asking for either a) The complete opposite (even ident DROPed by default) or b) Disabled firewall by default. Firewall default policy seems to be a very polarising subject ;) Some of the policy was discussed on previous requests, Some examples. https://bugzilla.novell.com/show_bug.cgi?id=348575 https://bugzilla.novell.com/show_bug.cgi?id=326569 and examples of kind of person who complains about even ident being rejected... https://bugzilla.novell.com/show_bug.cgi?id=183741 https://bugzilla.novell.com/show_bug.cgi?id=184062 https://bugzilla.novell.com/show_bug.cgi?id=183740 -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

https://bugzilla.novell.com/show_bug.cgi?id=368534 User Andreas.Stieger@gmx.de added comment https://bugzilla.novell.com/show_bug.cgi?id=368534#c3 --- Comment #3 from Andreas Stieger 2008-03-09 15:06:24 MST --- How about this? In yast, have a "firewall strategy" selection. [X] normal behaviour This protects you from unwanted access. Allowed services must be specified explicitly. REJECT illegal packages, reply to ICMP echo requests. This setting is the recommended default. [ ] stealth behaviour This protects you from unwanted access. Allowed services must be specified explicitly. DROP illegal packages, don't reply to ICMP echo requests. This setting might cause timeout on computers trying to connect instead of the expected "connection refused" message. -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

https://bugzilla.novell.com/show_bug.cgi?id=368534 User Andreas.Stieger@gmx.de added comment https://bugzilla.novell.com/show_bug.cgi?id=368534#c5 --- Comment #5 from Andreas Stieger 2008-03-09 16:04:56 MST --- Oh yes RFC 1918 detection is a great idea. Hmm... DSL PPPoE interfaces have a public IP address. -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

https://bugzilla.novell.com/show_bug.cgi?id=368534 User lnussel@novell.com added comment https://bugzilla.novell.com/show_bug.cgi?id=368534#c6 Ludwig Nussel changed: What |Removed |Added ---------------------------------------------------------------------------- Status|ASSIGNED |RESOLVED Resolution| |WONTFIX --- Comment #6 from Ludwig Nussel 2008-03-10 07:11:18 MST --- FW_ALLOW_PING_FW is enabled by default so ICMP echo works by default. FW_ALLOW_PING_DMZ and FW_ALLOW_PING_EXT have a different purpose, see their description in the config file. The purpose of dropping packages is to slow down port scans and not to hide the machine (which is impossible). The default therefore stays at DROP. -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.