From owner-freebsd-stable@FreeBSD.ORG  Mon Aug 12 13:38:53 2013
Return-Path: <owner-freebsd-stable@FreeBSD.ORG>
Delivered-To: freebsd-stable@freebsd.org
Received: from mx1.freebsd.org (mx1.freebsd.org [8.8.178.115])
 (using TLSv1 with cipher ADH-AES256-SHA (256/256 bits))
 (No client certificate requested)
 by hub.freebsd.org (Postfix) with ESMTP id D507A746;
 Mon, 12 Aug 2013 13:38:53 +0000 (UTC)
 (envelope-from tomek.cedro@gmail.com)
Received: from mail-qe0-x22c.google.com (mail-qe0-x22c.google.com
 [IPv6:2607:f8b0:400d:c02::22c])
 (using TLSv1 with cipher ECDHE-RSA-RC4-SHA (128/128 bits))
 (No client certificate requested)
 by mx1.freebsd.org (Postfix) with ESMTPS id 8912B2E73;
 Mon, 12 Aug 2013 13:38:53 +0000 (UTC)
Received: by mail-qe0-f44.google.com with SMTP id 6so3603164qeb.17
 for <multiple recipients>; Mon, 12 Aug 2013 06:38:52 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113;
 h=mime-version:sender:date:message-id:subject:from:to:content-type;
 bh=qAuRkYgEGFdYsjvBrG+0LwGGnJg7SabQr+uTpH/58Xo=;
 b=Siy/EpvdmTDWIbt7uUR8pxUs/8xLt40wXvDWtH25AxPVPSMc3fTy03aQv9cCfg22d0
 MaNRiAo1Dkj4lxfRKOw0BKoMQsCmC9dMxt4QFkFMNds56x2PxD2m82vEFzMoTUYe5P/Z
 fXCE7KOkye7aqiUX6bj21sdKzDJkLZexCZGAPZ51g479yu+8K2Xoq/GTEpetqRALS45M
 rnhRpPI0R9hOe4DUbLHnFK/ebt93vReq8PMyYqqzgHCTTNFN4EpPCA//3gPpeDnU9Ein
 UZsWm5TMHqbwo2UUIbQ4cn7QuA35FSfg5A9jhXomvqqsDLL/nJMeTIGE9WGz5v4T2xVW
 Tc3Q==
MIME-Version: 1.0
X-Received: by 10.224.93.19 with SMTP id t19mr24594863qam.32.1376314732562;
 Mon, 12 Aug 2013 06:38:52 -0700 (PDT)
Sender: tomek.cedro@gmail.com
Received: by 10.49.70.225 with HTTP; Mon, 12 Aug 2013 06:38:52 -0700 (PDT)
Date: Mon, 12 Aug 2013 15:38:52 +0200
X-Google-Sender-Auth: m9ADRDIqHQVLaOYyZP-K2LBBRdc
Message-ID: <CAFYkXjm1e1iYzLa3jSS8gU86N7etZnYmhiKF6EZqTwbP2jBEUg@mail.gmail.com>
Subject: 9.2-RC1 rc.firewall workstation type and myservices
From: CeDeROM <cederom@tlen.pl>
To: freebsd-stable@freebsd.org, 
 FreeBSD Questions Mailing List <freebsd-questions@freebsd.org>
Content-Type: text/plain; charset=UTF-8
X-BeenThere: freebsd-stable@freebsd.org
X-Mailman-Version: 2.1.14
Precedence: list
List-Id: Production branch of FreeBSD source code <freebsd-stable.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/options/freebsd-stable>,
 <mailto:freebsd-stable-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-stable>
List-Post: <mailto:freebsd-stable@freebsd.org>
List-Help: <mailto:freebsd-stable-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-stable>,
 <mailto:freebsd-stable-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Mon, 12 Aug 2013 13:38:53 -0000

Hello :-)

I just have setup some service on 9.2-RC1. I want this service to be
available on WAN but still I want to have stateful firewall running. I
am using workstation firewall type and put the service port on
firewall_myservices. However by default only TCP connections are
accepted, still I need to serve UDP connections. Wouldn't that be more
convenient to change "TCP" into "IP" for default firewall_myservices
and maybe add TCP and UDP for firewall_myservices_{tcp,udp} ? Below is
the script part..

Best regards,
Tomek

        # Add permits for this workstations published services below
        # Only IPs and nets in firewall_allowservices is allowed in.
        # If you really wish to let anyone use services on your
        # workstation, then set "firewall_allowservices='any'" in /etc/rc.conf
        #
        # Note: We don't use keep-state as that would allow DoS of
        #       our statetable.
        #       You can add 'keep-state' to the lines for slightly
        #       better performance if you fell that DoS of your
        #       workstation won't be a problem.
        #
        for i in ${firewall_allowservices} ; do
          for j in ${firewall_myservices} ; do
            ${fwcmd} add pass tcp from $i to me $j
          done
        done


-- 
CeDeROM, SQ7MHZ, http://www.tomek.cedro.info