Portsentry Kill_Route issue

[Bosco Tsang]

Portsentry is using the route command to drop off those illegal hosts. However, I've noted that it do not work, as it cannot add the route to a loopback address (127.0.0.1) as follows,

route add host xx.xx.xx.xx 127.0.0.1 1

which will return the error message "Network unreachable". It's the same if I use the actual ip address instead of 127.0.0.1. Why?

Any way for me to enter an invalid gateway etc so portsentry can drop off the traffic?

[harry d brown jr]

Why are you adding a hop count to the host's loopback address? I don't remember if that's correct, but maybe someone else can chime in here?

route add host xx.xx.xx.xx 127.0.0.1 1

live free or die
harry

[Ron Kinner · Accepted solution]

Chiming in. The 1 at the end indicates it is not a local address and is, in fact, one hop away. Should be a 0 if it's a local address.

Ron

[Keith Beckworth]

I'm running in to the same issue, but only on hpux 11.x systems. This (route add net 111.222.333.444 netmask 255.255.255.255 127.0.0.1) works corectly on 10.20. From what I've found 11.x tries to verify that the gateway is valid, if it's not then the command fails.

Does anyone know of a way to force the route command to create the staic entry to the loopback?

[Ron Kinner]

ndd -set /dev/ip ip_ire_gw_probe 0


Then if that works you need to put it in /etc/rc.config.d/nddconf so it will stay after a reboot.

TRANSPORT_NAME[0]=ip
NDD_NAME[0]=ip_ire_gw_probe
NDD_VALUE[0]=0

Use the next highest integer in the brackets if you already something there.

Ron