From owner-freebsd-questions@FreeBSD.ORG Fri Sep 17 16:14:55 2004 Return-Path: Delivered-To: freebsd-questions@freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id 729D816A4CE for ; Fri, 17 Sep 2004 16:14:55 +0000 (GMT) Received: from web41404.mail.yahoo.com (web41404.mail.yahoo.com [66.218.93.70]) by mx1.FreeBSD.org (Postfix) with SMTP id 3A43E43D54 for ; Fri, 17 Sep 2004 16:14:55 +0000 (GMT) (envelope-from davemac11@yahoo.com) Message-ID: <20040917161455.2473.qmail@web41404.mail.yahoo.com> Received: from [168.91.4.66] by web41404.mail.yahoo.com via HTTP; Fri, 17 Sep 2004 09:14:55 PDT Date: Fri, 17 Sep 2004 09:14:55 -0700 (PDT) From: Dave McCammon To: Bill Moran In-Reply-To: <20040917114427.24aac112.wmoran@potentialtech.com> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii cc: questions@freebsd.org Subject: Re: Too many dynamic rules, sorry X-BeenThere: freebsd-questions@freebsd.org X-Mailman-Version: 2.1.1 Precedence: list List-Id: User questions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 17 Sep 2004 16:14:55 -0000 > You'll generally need to keep state on UDP when you > play online games. > > If you're smart, you don't allow arbitrary UDP > packets from the outside > world into your network, but if you're playing > Unreal or something, then > all communication is via UDP, and you won't be able > to play. > > The best solution is to allow all UDP traffic to > _leave_, while keeping > state. the keep-state remembers the ip/port > information on the outgoing > packets, and thus allows return packets to get back > in (by matching the > ip/port pair). > > Now, when you know the port, it doesn't really make > sense to use > keep-state, and all you're really doing is spamming > your state tables. > > If you look in the /etc/rc.firewall that ships with > FreeBSD, you'll see > these rules (designed to handle running a DNS > server): > # Allow access to our DNS > ${fwcmd} add pass tcp from any to ${oip} 53 > setup > ${fwcmd} add pass udp from any to ${oip} 53 > ${fwcmd} add pass udp from ${oip} 53 to any > > Granted, it's three rules instead of 1, but it does > not use your state > tables unnecessarily (sp?) > Unless you have above the "#Allow access to our DNS" rules- ${fwcmd} add pass udp from ${oip} to any keep-state to allow all UDP to leave. the first incoming packet to port 53 will match the stateless rule ${fwcmd} add pass udp from any to ${oip} 53 but the reply will create a dynamic rule because first match is ${fwcmd} add pass udp from ${oip} to any keep-state _______________________________ Do you Yahoo!? Declare Yourself - Register online to vote today! http://vote.yahoo.com