Re: Matching DNAT'd packets

[Pascal Hambourg <pascal.mail@xxxxxxxxxxxxxxx>]

Philip Prindeville a écrit :
> There is an administrative web server that is used for configuration via
> GUI.
>
> The interface is accessible via port 80 internally... but we want to
> obscure it externally [...] We similarly obscure the Ssh port

Security through obscurity, just as I thought. Why don't you just have 
the web server and sshd listening on alternate ports and allow external 
access only on these ports ?
--
To unsubscribe from this list: send the line "unsubscribe linux-net" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at  http://vger.kernel.org/majordomo-info.html