When iptables stop the machine is a plain router

Maurice Hoeneveld wrote:
> Now something weird happens (at least for a firewall)
> When iptables stops working (manual, crashed or bufferoverflow by a
> DoS attack) the machine is a plain router/bridge. So all traffic is
> allowed based on the available routingtable in the machine.

It's the way it's meant to be, if you stop the firewall the machine
should be still working as a router, it's the way it's configured.
You can use NAT so if the firewall stops the packets stop being
routed to internet, or you can have a script that stops the routing
if the firewall is off.

I have not seen iptables crashing or stopping ever, it just stops
if you want to.

--

Jose Maria Lopez Hernandez
Director Tecnico de bgSEC
(E-Mail Removed)
bgSEC Seguridad y Consultoria de Sistemas Informaticos
http://www.bgsec.com
ESPAÑA

The only people for me are the mad ones -- the ones who are mad to live,
mad to talk, mad to be saved, desirous of everything at the same time,
the ones who never yawn or say a commonplace thing, but burn, burn, burn
like fabulous yellow Roman candles.
-- Jack Kerouac, "On the Road"

I do use a RedHat 7 hardened machine with with 4 interfaces and
iptables on it as a firewall.
There are several internal networks defined in the routing table of
this machine.

No consider the following;

When I use start iptables the machine acts like a firewall and only
traffic that is allowed in the rules is send trough the firewall. The
rest is blocked ofcourse.

Now something weird happens (at least for a firewall)
When iptables stops working (manual, crashed or bufferoverflow by a
DoS attack) the machine is a plain router/bridge. So all traffic is
allowed based on the available routingtable in the machine.

When I see other firewall systems like Checkpoint for example you can
see that when the firewall processes are killed, the machine also
stops routing and is a kind of stealth environment like it should be
in case of an incident.

Anyone know how to solve this issue because I dont want that when
iptables is stopped my trusted environment is public available.

Thanks for your help and suggestions in advance.

Maurice Hoeneveld
(E-Mail Removed)