Date: Fri, 06 Feb 2004 10:58:22 -0600 From: "Chris Nowlin" <Chris.Nowlin@co.travis.tx.us> To: <freebsd-questions@freebsd.org> Subject: firewall rule(s) for ports and packages Message-ID: <s0237360.026@GWMAIL.co.travis.tx.us>
next in thread | raw e-mail | index | archive | help
I'm trying out 5.1 and 5.2, and with each, I utilize IPFW2 for the firewall. My rules allow passive FTP from the server, but often this does not seem to cover me when adding ports. To temporarily solve this (each time with the intention to find the correct solution) I just add a rule at the top to allow tcp from any to any via any. When the port install is done, I delete that rule. This is certainly the way I've had to do it when adding ports inside a jail - even things that worked from the main server, don't get past the firewall from inside the jail. I use "to me" and "from me" to identify the server, which only has one network interface. It's listening on two IPs (after creating the jail, I had to ifconfig an alias for the interface) but I thought that "me" would imply any IP address the interface was listening to. Surely there is a better way. For the "me" part I can always have two rules, one allowing the appropriate traffic for each IP address (instead of just using "me") but what about a solution for the quick-fix when adding ports? Thanks, Chris
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?s0237360.026>