No, I think what they are testing is whether you have a bad firewall config.
e.g. You have decided you want to allow connections from inside your
firewall to port 443 on the outside (very reasonable), so you add rules:
Allow source (inside/any addr/any port) --> dest (outside/any/port 443)
Allow source (outside/any/port 443) --> dest (inside/any addr/any port)
This is a bad config because it also allows _incoming_ TCP connections
from port 443 on an external machine, to any port on any machine on your
internal network!
You need an extra rule above these which says:
Deny source (outside/any/port 443) --> dest (inside/any addr/any port)
where SYN=1 and ACK=0
to fix this problem.
-
To unsubscribe from this list: send the line "unsubscribe linux-net" in
the body of a message to majordomo@vger.rutgers.edu