IPFW and sysctl variables questions

[unixjingleman]

Hi
I'm wanting to write a simple firewall for my bastion host(mail server). In Linux you can enable source address verification as a sysctl variable. This defeats some spoofing attacks. Does "source address verification" have to be done in IPFW or is there a sysctl variable for for this? Also which icmp messages would you recommend dropping?(for the moment i don't have time to set up snort, so i want as little traffic as possible getting through)
How would you recommend dealing with fragmented packets, bearing in mind that the only other firewall in front of this mail server is my border router(Internet gateway)?
Thanks for any advice

[nilsgecko]

You don't have to set a sysctl for source checking with IPFW. You can do:
Off the top of my head,

ipfw add 00010 deny log ip from any to any not verrevpath

or

check-state

At the beginning which I believe does the same thing? Please anyone correct me if I'm wrong. The info is in the man page too.

As far as icmp types, check out this website for an example ruleset where the author explains which ones he's allowed etc.

http://securosis.com/blog/help-build...ules-sets-ever