From owner-freebsd-security Sun Feb 24 8: 8:26 2002 Delivered-To: freebsd-security@freebsd.org Received: from cithaeron.argolis.org (bgm-66-67-16-161.stny.rr.com [66.67.16.161]) by hub.freebsd.org (Postfix) with ESMTP id 5D71337B400 for ; Sun, 24 Feb 2002 08:08:23 -0800 (PST) Received: from localhost (piechota@localhost) by cithaeron.argolis.org (8.11.6/8.11.4) with ESMTP id g1OG8Km17540; Sun, 24 Feb 2002 11:08:20 -0500 (EST) (envelope-from piechota@argolis.org) X-Authentication-Warning: cithaeron.argolis.org: piechota owned process doing -bs Date: Sun, 24 Feb 2002 11:08:20 -0500 (EST) From: Matt Piechota To: Ralph Huntington Cc: freebsd-security@FreeBSD.ORG Subject: Re: Couple of concerns with default rc.firewall In-Reply-To: <20020224104008.H14963-100000@mohegan.mohawk.net> Message-ID: <20020224110246.M17449-100000@cithaeron.argolis.org> MIME-Version: 1.0 Content-Type: TEXT/PLAIN; charset=US-ASCII Sender: owner-freebsd-security@FreeBSD.ORG Precedence: bulk List-ID: List-Archive: (Web Archive) List-Help: (List Instructions) List-Subscribe: List-Unsubscribe: X-Loop: FreeBSD.org On Sun, 24 Feb 2002, Ralph Huntington wrote: > Maybe I'm missing the point, but doesn't "deny ip from any to any" (which > is the last rule in a block-all-by-default firewall) doesn't that mean to > block everything, meaning everything? Nothing would be allowed, not any > icmp of any type or anything else. In order to allow anything in > particular, that would have to be explicitly enabled in a prior (ipfw) > rule, is that not correct? I think the question is did the FreeBSD team intentionally (for the reasons of security) make the default install non-compliant with some RFCs (read: broken), or was it just not thought of? And second, should this be changed? I don't think the original poster was suggesting that deny ip from any to any shouldn't block anything, just asking should there be a rule in rc.firewall in the default install to allow ICMP so the machine is well behaved. -- Matt Piechota To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-security" in the body of the message