From owner-freebsd-ipfw@FreeBSD.ORG Sun Nov 28 14:41:32 2004 Return-Path: Delivered-To: freebsd-ipfw@freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id 9499216A4CE for ; Sun, 28 Nov 2004 14:41:32 +0000 (GMT) Received: from yearning.mcc.ac.uk (yearning.mcc.ac.uk [130.88.203.23]) by mx1.FreeBSD.org (Postfix) with ESMTP id 1187343D58 for ; Sun, 28 Nov 2004 14:41:32 +0000 (GMT) (envelope-from jcm@FreeBSD-uk.eu.org) Received: from dogma.freebsd-uk.eu.org ([130.88.200.97]) by yearning.mcc.ac.uk with esmtp (Exim 4.43 (FreeBSD)) id 1CYQF1-000HVh-49 for freebsd-ipfw@freebsd.org; Sun, 28 Nov 2004 14:41:31 +0000 Received: from dogma.freebsd-uk.eu.org (localhost [127.0.0.1]) iASEfUlZ020863 for ; Sun, 28 Nov 2004 14:41:30 GMT (envelope-from jcm@dogma.freebsd-uk.eu.org) Received: (from jcm@localhost) by dogma.freebsd-uk.eu.org (8.12.10/8.12.6/Submit) id iASEfUke020862 for freebsd-ipfw@freebsd.org; Sun, 28 Nov 2004 14:41:30 GMT Date: Sun, 28 Nov 2004 14:41:29 +0000 From: Jonathon McKitrick To: freebsd-ipfw@freebsd.org Message-ID: <20041128144129.GA20832@dogma.freebsd-uk.eu.org> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline User-Agent: Mutt/1.4i Subject: Fwd: Is this a hole in my firewall? X-BeenThere: freebsd-ipfw@freebsd.org X-Mailman-Version: 2.1.1 Precedence: list List-Id: IPFW Technical Discussions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 28 Nov 2004 14:41:32 -0000 Here are my rules: root@neptune:~# ipfw show 00100 0 0 check-state 00200 2 144 allow ip from me to any keep-state out xmit tun0 00300 0 0 allow ip from any to any keep-state out xmit tun0 00400 0 0 deny tcp from any to any in recv tun0 established 00500 0 0 allow ip from any to any via vr0 00600 0 0 allow ip from any to any via lo0 00700 0 0 deny ip from any to 127.0.0.0/8 00800 0 0 deny ip from 127.0.0.0/8 to any 00900 0 0 allow tcp from any to me 22 keep-state in recv vr0 setup 01000 0 0 allow icmp from any to any via tun0 icmptype 0,3,8,11,12 01100 0 0 deny log logamount 100 ip from any to any 65535 0 0 deny ip from any to any I added rule 300 so that my laptop on my wireless network can connect, ping, and get DNS and DHCP. Is there a better way to specify this? jm --