From owner-freebsd-pf@FreeBSD.ORG  Mon Oct  9 14:36:41 2006
Return-Path: <owner-freebsd-pf@FreeBSD.ORG>
X-Original-To: freebsd-pf@freebsd.org
Delivered-To: freebsd-pf@freebsd.org
Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125])
	by hub.freebsd.org (Postfix) with ESMTP id D214016A416
	for <freebsd-pf@freebsd.org>; Mon,  9 Oct 2006 14:36:41 +0000 (UTC)
	(envelope-from eculp@bafirst.com)
Received: from lora.pns.networktel.net (jor-l.pns.networktel.net
	[216.83.236.236])
	by mx1.FreeBSD.org (Postfix) with ESMTP id 9235843D55
	for <freebsd-pf@freebsd.org>; Mon,  9 Oct 2006 14:36:37 +0000 (GMT)
	(envelope-from eculp@bafirst.com)
Received: from bafirst.com (72-12-2-214.wan.networktel.net [72.12.2.214])
	by lora.pns.networktel.net (8.13.6/8.12.11) with ESMTP id
	k99EZ21P086950
	for <freebsd-pf@freebsd.org>; Mon, 9 Oct 2006 14:35:08 GMT
	(envelope-from eculp@bafirst.com)
Received: from localhost (localhost [127.0.0.1]) (uid 80)
	by bafirst.com with local; Mon, 09 Oct 2006 09:36:15 -0500
	id 00095809.452A5E5F.00000CF7
Received: from dsl-189-129-17-243.prod-infinitum.com.mx
	(dsl-189-129-17-243.prod-infinitum.com.mx [189.129.17.243]) by
	mail.bafirst.com (Horde MIME library) with HTTP;
	Mon, 09 Oct 2006 09:36:15 -0500
Message-ID: <20061009093615.ik9e6k87k88kcggg@mail.bafirst.com>
Date: Mon, 09 Oct 2006 09:36:15 -0500
From: eculp@bafirst.com
To: freebsd-pf@freebsd.org
References: <000301c6eb6e$b49aeda0$0201a8c0@vaio>
In-Reply-To: <000301c6eb6e$b49aeda0$0201a8c0@vaio>
MIME-Version: 1.0
Content-Type: text/plain;
	charset=ISO-8859-1;
	format="flowed"
Content-Disposition: inline
Content-Transfer-Encoding: 7bit
User-Agent: Internet Messaging Program (IMP) 4.1-cvs
X-Virus-Scanned: ClamAV version 0.84,
	clamav-milter version 0.84e on lora.pns.networktel.net
X-Virus-Status: Clean
Subject: Greg's side note
X-BeenThere: freebsd-pf@freebsd.org
X-Mailman-Version: 2.1.5
Precedence: list
List-Id: "Technical discussion and general questions about packet filter
	\(pf\)" <freebsd-pf.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-pf>,
	<mailto:freebsd-pf-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-pf>
List-Post: <mailto:freebsd-pf@freebsd.org>
List-Help: <mailto:freebsd-pf-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-pf>,
	<mailto:freebsd-pf-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Mon, 09 Oct 2006 14:36:41 -0000

< snip >

> On a side note,
>
> The default block rule should match both ingress and egress traffic.
> A system cannot be deemed secure it if implictly allows egress traffic to
> flow.

Makes sense but I haven't done it do to an ignorance of which 
unprivileged ports need to be enabled for things like skype, IM etc.  
Does anyone have any recommendations as to where a list of ports used 
by programs like the above can be found or a restricted range of ports 
that has worked for you?

Thanks,

ed