From owner-svn-doc-head@freebsd.org Tue Jan 3 16:28:14 2017 Return-Path: Delivered-To: svn-doc-head@mailman.ysv.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:1900:2254:206a::19:1]) by mailman.ysv.freebsd.org (Postfix) with ESMTP id 3B2F4C9D76B; Tue, 3 Jan 2017 16:28:14 +0000 (UTC) (envelope-from maxim.konovalov@gmail.com) Received: from mp2.macomnet.net (mp2.macomnet.net [195.128.64.6]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (Client did not present a certificate) by mx1.freebsd.org (Postfix) with ESMTPS id BDD11111D; Tue, 3 Jan 2017 16:28:13 +0000 (UTC) (envelope-from maxim.konovalov@gmail.com) Received: from localhost (localhost [127.0.0.1]) by mp2.macomnet.net (8.15.2/8.15.2) with ESMTP id v03GS3Oq095280; Tue, 3 Jan 2017 19:28:03 +0300 (MSK) (envelope-from maxim.konovalov@gmail.com) Date: Tue, 3 Jan 2017 19:28:03 +0300 (MSK) From: Maxim Konovalov To: Warren Block cc: Warren Block , doc-committers@freebsd.org, svn-doc-all@freebsd.org, svn-doc-head@freebsd.org Subject: Re: svn commit: r49600 - head/en_US.ISO8859-1/books/handbook/firewalls In-Reply-To: Message-ID: References: <201610281531.u9SFVL7u096914@repo.freebsd.org> User-Agent: Alpine 2.20 (BSF 67 2015-01-07) MIME-Version: 1.0 Content-Type: text/plain; charset=US-ASCII X-BeenThere: svn-doc-head@freebsd.org X-Mailman-Version: 2.1.23 Precedence: list List-Id: SVN commit messages for the doc tree for head List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 03 Jan 2017 16:28:14 -0000 > > Hi Warren, > > > > On Fri, 28 Oct 2016, 15:31-0000, Warren Block wrote: > > > > [...] > > > # Allow outbound NTP > > > -$cmd 00260 allow tcp from any to any 37 out via $pif setup > > > keep-state > > > +$cmd 00260 allow udp from any to any 123 out via $pif setup > > > keep-state > > > > > > # Allow outbound SSH > > > $cmd 00280 allow tcp from any to any 22 out via $pif setup > > > keep-state > > > > > Are you sure about this change? NTP is UDP based protocol. In the > > same time "setup" is TCP only feature (why ipfw(8) allows it to use in > > conjunction with the UDP proto is a different story) > > > > I think the comment is what should be fixed here. > > https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=213365 suggested merely > changing this to UDP 123. I don't use IPFW, so can't verify the actual usage. > Help would be appreciated. > I'd remove the "setup" keyword from the command. Let me know if I can go ahead with this change. -- Maxim Konovalov