From owner-freebsd-isp  Tue Jan 18  9:40:48 2000
Delivered-To: freebsd-isp@freebsd.org
Received: from gndrsh.dnsmgr.net (GndRsh.dnsmgr.net [198.145.92.4])
	by hub.freebsd.org (Postfix) with ESMTP
	id 7DF9614F55; Tue, 18 Jan 2000 09:40:41 -0800 (PST)
	(envelope-from freebsd@gndrsh.dnsmgr.net)
Received: (from freebsd@localhost)
	by gndrsh.dnsmgr.net (8.9.3/8.9.3) id JAA48605;
	Tue, 18 Jan 2000 09:40:33 -0800 (PST)
	(envelope-from freebsd)
From: "Rodney W. Grimes" <freebsd@gndrsh.dnsmgr.net>
Message-Id: <200001181740.JAA48605@gndrsh.dnsmgr.net>
Subject: Re: New Firewall
In-Reply-To: <Pine.BSF.4.10.10001181118180.42481-100000@bsdie.rwsystems.net> from James Wyatt at "Jan 18, 2000 11:22:31 am"
To: jwyatt@rwsystems.net (James Wyatt)
Date: Tue, 18 Jan 2000 09:40:33 -0800 (PST)
Cc: oogali@intranova.net (Omachonu Ogali),
	briang@expnet.net (Brian Gallucci), isp@FreeBSD.ORG,
	freebsd-ipfw@FreeBSD.ORG
X-Mailer: ELM [version 2.4ME+ PL54 (25)]
MIME-Version: 1.0
Content-Type: text/plain; charset=US-ASCII
Content-Transfer-Encoding: 7bit
Sender: owner-freebsd-isp@FreeBSD.ORG
Precedence: bulk
X-Loop: FreeBSD.org

> On Tue, 18 Jan 2000, Omachonu Ogali wrote:
> > The following rules can help if you are going to be running SMTP, HTTP,
> > POP3, and HTTPS, delete what you don't need.
> 	[ ... ]
> > # -- Deny setup of other incoming connections
> > ipfw add deny tcp from any to any setup
> > 
> > # -- Deny other incoming IP packets.
> > ipfw add deny ip from any to any
> 
> These rules are duplicate, so you can drop the first one. The last rule is
> commonly the default in /etc/rc.firewall as well. That aside, I might keep
> the first one and change it to '... deny log ...", thus logging connection
> attempts. On the other hand, that's what log_in_vain="YES" in /etc/rc.conf
> is all about... - Jy@

These rules are not equivelent, ip != tcp, and setup != null.  The first
rule is _VERY_ important.  The second can be eliminated, see other email
from me on missing ``setup'' on all the other rules...

-- 
Rod Grimes - KD7CAX @ CN85sl - (RWG25)               rgrimes@gndrsh.dnsmgr.net


To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-isp" in the body of the message