From owner-freebsd-questions@FreeBSD.ORG Sat Feb 14 10:58:49 2004 Return-Path: Delivered-To: freebsd-questions@freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id F3F1516A4CE for ; Sat, 14 Feb 2004 10:58:48 -0800 (PST) Received: from falcon.midgard.homeip.net (h201n1fls24o1048.bredband.comhem.se [212.181.162.201]) by mx1.FreeBSD.org (Postfix) with SMTP id 003EC43D1F for ; Sat, 14 Feb 2004 10:58:47 -0800 (PST) (envelope-from ertr1013@student.uu.se) Received: (qmail 66377 invoked by uid 1001); 14 Feb 2004 18:58:45 -0000 Date: Sat, 14 Feb 2004 19:58:45 +0100 From: Erik Trulsson To: Eric F Crist Message-ID: <20040214185845.GA66227@falcon.midgard.homeip.net> Mail-Followup-To: Eric F Crist , freebsd-questions@freebsd.org, Barbish3@adelphia.net References: <402E6027.6010500@daleco.biz> <200402141200.23393.ecrist@adtechintegrated.com> <200402141247.13325.ecrist@adtechintegrated.com> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <200402141247.13325.ecrist@adtechintegrated.com> User-Agent: Mutt/1.5.6i cc: Barbish3@adelphia.net cc: freebsd-questions@freebsd.org Subject: Re: IPFW ruleset not working... advice? WAS Re: Running processes... X-BeenThere: freebsd-questions@freebsd.org X-Mailman-Version: 2.1.1 Precedence: list List-Id: User questions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 14 Feb 2004 18:58:49 -0000 On Sat, Feb 14, 2004 at 12:47:01PM -0600, Eric F Crist wrote: > Hello all, > > I've got the following ruleset, but I can't ssh into my server anymore. What > did I miss? You missed allowing IP packets going from your server to the outside. You only allow packets from the outside to you. I also think you might have misplaced the port numbers. As it is you allow connections *from* port 25 (etc.) on the outside to any port on your machine. I believe you want it the other way around (i.e. allowing connections *to* port 25 on your machine from anywhere on the outside.) > > grog# ipfw show > 00100 0 0 allow ip from any to any via lo0 > 00200 0 0 deny ip from any to 127.0.0.0/8 > 00300 0 0 deny ip from 127.0.0.0/8 to any > 00400 7 1562 allow ip from 1.2.3.4/29 to me > 00500 0 0 allow ip from any 22 to me > 00600 0 0 allow ip from any 21 to me > 00700 0 0 allow ip from any 25 to me > 00800 0 0 allow ip from any 80 to me > 00900 0 0 allow ip from any 443 to me > 01000 0 0 allow ip from any 110 to me > 01100 0 0 allow ip from any 53 to me > 01200 0 0 allow ip from any 6667 to me > 01300 0 0 allow ip from any 6668 to me > 01400 0 0 deny ip from not 1.2.3.4/29 8080 to me > 65535 101 13960 deny ip from any to any > > Thanks. > > -- > Eric F Crist > AdTech Integrated Systems, Inc > (612) 998-3588 -- Erik Trulsson ertr1013@student.uu.se