From owner-freebsd-security Sun Nov 26 11:37:24 2000 Delivered-To: freebsd-security@freebsd.org Received: from mailhost01.reflexnet.net (mailhost01.reflexnet.net [64.6.192.82]) by hub.freebsd.org (Postfix) with ESMTP id 8F52337B4C5 for ; Sun, 26 Nov 2000 11:37:22 -0800 (PST) Received: from 149.211.6.64.reflexcom.com ([64.6.211.149]) by mailhost01.reflexnet.net with Microsoft SMTPSVC(5.5.1877.197.19); Sun, 26 Nov 2000 11:35:51 -0800 Received: (from cjc@localhost) by 149.211.6.64.reflexcom.com (8.11.0/8.11.0) id eAQJbLq70271; Sun, 26 Nov 2000 11:37:21 -0800 (PST) (envelope-from cjc) Date: Sun, 26 Nov 2000 11:37:21 -0800 From: "Crist J . Clark" To: Nuno Teixeira Cc: freebsd-security@FreeBSD.ORG Subject: Re: NATD: failed to write packet back (Permission denied) Message-ID: <20001126113720.A70192@149.211.6.64.reflexcom.com> Reply-To: cjclark@alum.mit.edu References: <001701c057c4$1e1ac010$0200a8c0@n2> <20001126110756.C34151@149.211.6.64.reflexcom.com> <000b01c057dd$f9423ab0$0200a8c0@n2> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii X-Mailer: Mutt 1.0i In-Reply-To: <000b01c057dd$f9423ab0$0200a8c0@n2>; from nuno.teixeira@pt-quorum.com on Sun, Nov 26, 2000 at 07:20:41PM -0000 Sender: owner-freebsd-security@FreeBSD.ORG Precedence: bulk X-Loop: FreeBSD.org On Sun, Nov 26, 2000 at 07:20:41PM -0000, Nuno Teixeira wrote: > Hi, > > I think not. Can you tell me how to add this rule to my ruleset? The two rules needed to get UNIX-style traceroutes to work are, Sfwcmd add allow udp from any to any 33434-33474 out via ${oif} $fwcmd add allow icmp from any to any icmptype 3,11 in via ${oif} But you already have a more promiscuous rule for ICMP so that is not needed. 'oif' is your external interface on a gateway machine. -- Crist J. Clark cjclark@alum.mit.edu To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-security" in the body of the message