From owner-freebsd-questions  Wed Jan  6 09:44:22 1999
Return-Path: <owner-freebsd-questions@FreeBSD.ORG>
Received: (from majordom@localhost)
          by hub.freebsd.org (8.8.8/8.8.8) id JAA12060
          for freebsd-questions-outgoing; Wed, 6 Jan 1999 09:44:22 -0800 (PST)
          (envelope-from owner-freebsd-questions@FreeBSD.ORG)
Received: from guru.phone.net (guru.phone.net [209.157.82.120])
          by hub.freebsd.org (8.8.8/8.8.8) with SMTP id JAA12050
          for <freebsd-questions@FreeBSD.ORG>; Wed, 6 Jan 1999 09:44:20 -0800 (PST)
          (envelope-from mwm@phone.net)
Received: (qmail 22396 invoked by uid 100); 6 Jan 1999 17:43:53 -0000
Received: from localhost (sendmail-bs@127.0.0.1)
  by localhost with SMTP; 6 Jan 1999 17:43:53 -0000
Date: Wed, 6 Jan 1999 09:43:53 -0800 (PST)
From: Mike Meyer <mwm@phone.net>
To: Yusuf Goolamabbas <yusufg@huge.net>
cc: freebsd-questions@FreeBSD.ORG
Subject: Re: How to allow incoming DNS via 'client' prof in rc.firewall
In-Reply-To: <19990106205928.A23282@huge.net>
Message-ID: <Pine.BSF.4.05.9901060942080.25797-100000@guru.phone.net>
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
Sender: owner-freebsd-questions@FreeBSD.ORG
Precedence: bulk
X-Loop: FreeBSD.ORG

Hmm - I missed one. Seems that DNS runs on both UDP and TCP. Try
adding those two as well:

	/sbin/ipfw add pass tcp from any to ${ip} 53
	/sbin/ipfw add pass tcp from ${ip} any to 53

Note that you need to allow both "setup" and "established" (you were
working with those before), so you might as well allow both. If you've
already got 

	/sbin/ipfw add pass tcp from any to any established

you can add "setup" to the above two lines for slightly tighter
control.

	<mike

On Wed, 6 Jan 1999, Yusuf Goolamabbas wrote:

> Date: Wed, 6 Jan 1999 20:59:28 +0800
> From: Yusuf Goolamabbas <yusufg@huge.net>
> To: Mike Meyer <mwm@phone.net>
> Cc: freebsd-questions@FreeBSD.ORG
> Subject: Re: How to allow incoming DNS via 'client' prof in rc.firewall
> 
> > You need to allow both incoming and outgoing packets, and for udp, not
> > tcp. Try:
> > 
> > 	/sbin/ipfw add pass udp from any to ${ip} 53
> > 	/sbin/ipfw add pass udp from ${ip} to any 53
> 
> Hi Mike, I added the first rule (second rule is their as part of
> "client"). However. I get no response when queried from external network
> 
> Anything, I could be doing wrong still ?
> 
> > 
> > 	<mike
> > 
> 
> -- 
> Yusuf Goolamabbas
> yusufg@huge.net
> 
> To Unsubscribe: send mail to majordomo@FreeBSD.org
> with "unsubscribe freebsd-questions" in the body of the message
> 


To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-questions" in the body of the message