From owner-freebsd-questions@FreeBSD.ORG  Wed Feb 19 06:24:02 2014
Return-Path: <owner-freebsd-questions@FreeBSD.ORG>
Delivered-To: freebsd-questions@freebsd.org
Received: from mx1.freebsd.org (mx1.freebsd.org
 [IPv6:2001:1900:2254:206a::19:1])
 (using TLSv1 with cipher ADH-AES256-SHA (256/256 bits))
 (No client certificate requested)
 by hub.freebsd.org (Postfix) with ESMTPS id 779577A5
 for <freebsd-questions@freebsd.org>; Wed, 19 Feb 2014 06:24:02 +0000 (UTC)
Received: from mail-ea0-x22f.google.com (mail-ea0-x22f.google.com
 [IPv6:2a00:1450:4013:c01::22f])
 (using TLSv1 with cipher ECDHE-RSA-RC4-SHA (128/128 bits))
 (No client certificate requested)
 by mx1.freebsd.org (Postfix) with ESMTPS id 111481DEC
 for <freebsd-questions@freebsd.org>; Wed, 19 Feb 2014 06:24:01 +0000 (UTC)
Received: by mail-ea0-f175.google.com with SMTP id n15so107525ead.6
 for <freebsd-questions@freebsd.org>; Tue, 18 Feb 2014 22:24:00 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113;
 h=mime-version:in-reply-to:references:date:message-id:subject:from:to
 :cc:content-type;
 bh=NQhJ6VIBom6h7E1IHaSxy53QARBoCc21N0jaqz/oJsc=;
 b=ptFCGoWkgslSfUuSF5znktimpmxmggCvcruYpOsthQWwwgzvBDmKKJnxnY7FUSPf10
 EVTNUQqg9mwiFDI7eG6f8LU5IhQCkl+ycbhI/2zA8mv91UiEcB/1VpIXfO1p43f0c1oK
 yZtSzzhoC+k9/pvU4j1ZJBfIusjeez2YJzUz7FLdVRVGnV3OjljD0GfjSNWCwuedok1o
 0d+WrCCSkfwTTnPCT0IUFh4cnlqk27kEQlAx1QovmaJ/CS3CtQeSY4Rf0Zb4253iuaMY
 +S/hZAO1UG6adDUWcGcvIyBGm9fh0NW2aCYcN3fVrtNg3qwv5wiLiG8lp/E1XHolsH3T
 muRg==
MIME-Version: 1.0
X-Received: by 10.15.93.203 with SMTP id w51mr38835959eez.33.1392791040339;
 Tue, 18 Feb 2014 22:24:00 -0800 (PST)
Received: by 10.14.119.135 with HTTP; Tue, 18 Feb 2014 22:24:00 -0800 (PST)
In-Reply-To: <3975.1392779391@server1.tristatelogic.com>
References: <3975.1392779391@server1.tristatelogic.com>
Date: Tue, 18 Feb 2014 22:24:00 -0800
Message-ID: <CADy1Ce7RFnSvv=1LC+AAXeJGS7C7atqVhwHqvo0Mr_6++wJGYQ@mail.gmail.com>
Subject: Re: [SOLVED] Re: Semi-urgent: Disable NTP replies?
From: Kurt Buff <kurt.buff@gmail.com>
To: "Ronald F. Guilmette" <rfg@tristatelogic.com>
Content-Type: text/plain; charset=UTF-8
Cc: "freebsd-questions@freebsd.org" <freebsd-questions@freebsd.org>
X-BeenThere: freebsd-questions@freebsd.org
X-Mailman-Version: 2.1.17
Precedence: list
List-Id: User questions <freebsd-questions.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/options/freebsd-questions>, 
 <mailto:freebsd-questions-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-questions/>
List-Post: <mailto:freebsd-questions@freebsd.org>
List-Help: <mailto:freebsd-questions-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-questions>, 
 <mailto:freebsd-questions-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Wed, 19 Feb 2014 06:24:02 -0000

On Tue, Feb 18, 2014 at 7:09 PM, Ronald F. Guilmette
<rfg@tristatelogic.com> wrote:
>
>
> Thanks much to everybody who responded.  All of the responses were
> enlightening and much appreciated.
>
> Obviously, yes, I screwed up big time when I constructed my firewall
> rules, and I was inadvertantly and unintentionally allowing stuff to
> come in from the outside on udp/123.
>
> That is no longer the case.  I now have a rule in place to block it
> all... and I'm not likely to make THAT mistake again!  (Live and
> learn.)


This is the important lesson - learning. Don't worry about it, you
fixed it - many of us got caught out by it, even those who, like me,
preach "default deny".

So, in that vein, this notice:

TA14-017A: UDP-based Amplification Attacks
https://www.us-cert.gov/ncas/alerts/TA14-017A

Kurt