From owner-freebsd-questions Tue Mar 20 14:22: 7 2001 Delivered-To: freebsd-questions@freebsd.org Received: from guru.mired.org (okc-65-26-235-186.mmcable.com [65.26.235.186]) by hub.freebsd.org (Postfix) with SMTP id 1F3D237B76D for ; Tue, 20 Mar 2001 14:04:14 -0800 (PST) (envelope-from mwm@mired.org) Received: (qmail 76103 invoked by uid 100); 20 Mar 2001 22:04:12 -0000 From: Mike Meyer MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: 7bit Message-ID: <15031.54236.844978.222832@guru.mired.org> Date: Tue, 20 Mar 2001 16:04:12 -0600 To: "Pablo Bendersky" Cc: questions@freebsd.org Subject: Re: Too many dynamic rules In-Reply-To: <28795958@toto.iv> X-Mailer: VM 6.89 under 21.1 (patch 14) "Cuyahoga Valley" XEmacs Lucid X-face: "5Mnwy%?j>IIV\)A=):rjWL~NB2aH[}Yq8Z=u~vJ`"(,&SiLvbbz2W`;h9L,Yg`+vb1>RG% *h+%X^n0EZd>TM8_IB;a8F?(Fb"lw'IgCoyM.[Lg#r\ Sender: owner-freebsd-questions@FreeBSD.ORG Precedence: bulk X-Loop: FreeBSD.ORG Pablo Bendersky types: > Hi ! > > I'm getting this error on my firewall: > > /kernel: Too many dynamic rules, sorry > > My rules are as follows: > 00100 allow ip from any to any via lo0 > 00200 deny ip from any to 127.0.0.0/8 > 00500 deny ip from any to 10.0.0.0/8 via xl1 > 00600 deny ip from any to 172.16.0.0/12 via xl1 > 00700 deny ip from any to 192.168.0.0/16 via xl1 > 00800 deny ip from any to 0.0.0.0/8 via xl1 > 00900 deny ip from any to 169.254.0.0/16 via xl1 > 01000 deny ip from any to 192.0.2.0/24 via xl1 > 01100 deny ip from any to 224.0.0.0/4 via xl1 > 01200 deny ip from any to 240.0.0.0/4 via xl1 > 01300 divert 8668 ip from any to any > 01400 deny ip from 10.0.0.0/8 to any via xl1 > 01500 deny ip from 172.16.0.0/12 to any via xl1 > 01600 deny ip from 192.168.0.0/16 to any via xl1 > 01700 deny ip from 0.0.0.0/8 to any via xl1 > 01800 deny ip from 169.254.0.0/16 to any via xl1 > 01900 deny ip from 192.0.2.0/24 to any via xl1 > 02000 deny ip from 224.0.0.0/4 to any via xl1 > 02100 deny ip from 240.0.0.0/4 to any via xl1 > 02200 check-state > 02300 allow ip from any to any frag > 02400 allow ip from any to any keep-state > 65535 deny ip from any to any > > As you can see, it's a very open firewall. I'm not sure why do I need the > keep-state, and the check-state. I've seen (I think) that without using it I > cannot use the active FTP, is it right ? Or I can just replace the rules > 2200 and 2400 for > 2400 allow ip from any to any > and that is ? Yup, just use those. The keep-state adds a dynamic rule as connections are made to allow packets using those connection to work. The check-state checks the dynamic rules. Since you're allowing them all through anyway, just skip the state stuff. http://www.mired.org/home/mwm/ Independent WWW/Perforce/FreeBSD/Unix consultant, email for more information. To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-questions" in the body of the message