Date: Sat, 27 Nov 2004 19:01:17 -0600 From: "Kevin D. Kinsey, DaleCo, S.P." <kdk@daleco.biz> To: Jonathon McKitrick <jcm@FreeBSD-uk.eu.org> Cc: freebsd-questions@freebsd.org Subject: Re: Is this a hole in my firewall? Message-ID: <41A9235D.7050806@daleco.biz> In-Reply-To: <20041127215612.GA86416@dogma.freebsd-uk.eu.org> References: <20041127215612.GA86416@dogma.freebsd-uk.eu.org>
next in thread | previous in thread | raw e-mail | index | archive | help
Jonathon McKitrick wrote: >Here are my rules: > >root@neptune:~# ipfw show >00100 0 0 check-state >00200 2 144 allow ip from me to any keep-state out xmit tun0 >00300 0 0 allow ip from any to any keep-state out xmit tun0 >00400 0 0 deny tcp from any to any in recv tun0 established >00500 0 0 allow ip from any to any via vr0 >00600 0 0 allow ip from any to any via lo0 >00700 0 0 deny ip from any to 127.0.0.0/8 >00800 0 0 deny ip from 127.0.0.0/8 to any >00900 0 0 allow tcp from any to me 22 keep-state in recv vr0 setup >01000 0 0 allow icmp from any to any via tun0 icmptype 0,3,8,11,12 >01100 0 0 deny log logamount 100 ip from any to any >65535 0 0 deny ip from any to any > >I added rule 300 so that my laptop on my wireless network can connect, ping, >and get DNS and DHCP. Is there a better way to specify this? > >jm > > Well, maybe; is the laptop's IP assigned statically or dynamically? If static, I suppose "allow ip from lap.top.id.addr to any keep-state out xmit tun0" would be the thing. You can also specify the network: "allow ip from any 192.168.0/24 to any keep-state out via tun0". HTH,
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?41A9235D.7050806>