From owner-freebsd-questions  Fri Oct  4  1: 4:13 2002
Delivered-To: freebsd-questions@freebsd.org
Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125])
	by hub.freebsd.org (Postfix) with ESMTP id 991DD37B401
	for <freebsd-questions@freebsd.org>; Fri,  4 Oct 2002 01:04:11 -0700 (PDT)
Received: from brabys.co.za (postoffice.brabys.co.za [192.96.48.13])
	by mx1.FreeBSD.org (Postfix) with ESMTP id A9A2943E65
	for <freebsd-questions@freebsd.org>; Fri,  4 Oct 2002 01:04:07 -0700 (PDT)
	(envelope-from nelis@brabys.co.za)
Received: from nelis.brabys.co.za (proxy-inner.brabys.co.za [192.96.48.11])
	by brabys.co.za (8.12.0/8.12.0) with ESMTP id g9482vCq012166
	for <freebsd-questions@freebsd.org>; Fri, 4 Oct 2002 10:02:57 +0200
Message-Id: <5.1.0.14.2.20021004095502.0460ad18@192.96.48.11>
X-Sender: nelis@192.96.48.11
X-Mailer: QUALCOMM Windows Eudora Version 5.1
Date: Fri, 04 Oct 2002 10:03:04 +0200
To: freebsd-questions@freebsd.org
From: Nelis Lamprecht <nelis@brabys.co.za>
Subject: Re: ipfw ruleset
Mime-Version: 1.0
Content-Type: text/plain; charset="us-ascii"; format=flowed
X-MailScanner: Found to be clean
Sender: owner-freebsd-questions@FreeBSD.ORG
Precedence: bulk
List-ID: <freebsd-questions.FreeBSD.ORG>
List-Archive: <http://docs.freebsd.org/mail/> (Web Archive)
List-Help: <mailto:majordomo@FreeBSD.ORG?subject=help> (List Instructions)
List-Subscribe: <mailto:majordomo@FreeBSD.ORG?subject=subscribe%20freebsd-questions>
List-Unsubscribe: <mailto:majordomo@FreeBSD.ORG?subject=unsubscribe%20freebsd-questions>
X-Loop: FreeBSD.ORG

whoops, never mind people I have just realized blocking all udp except for 
on port 53 does not allow other DNS servers to do queries to my host ( even 
though I can query them ). would help if I actually bothered to read my 
logs once in awhile :O)

>Hi People,
>
>I'm trying to setup my firewall using ipfw on 4.6 Stable. I have read 
>through the man pages and also several howto's but now I need your advice. 
>I would like to setup a DNS server that will respond to queries and my 
>current ruleset does not seem to permit this. Please tell me what I am 
>doing wrong.
>
>My Ruleset: ( ip's omitted )
>
>add 00301 check-state
>add 00302 allow tcp from any to any established
>add 00303 allow tcp from any to any out setup keep-state
>add 00304 allow tcp from any to $lan 22,25,80,443 setup
>add 00400 allow udp from any to any out
>add 00401 allow udp from $lan to any 53
>add 00402 allow udp from any 53 to $lan in recv rl0
>#allow some icmp types (codes not supported)
>##allow path-mtu in both directions
>add 00600 allow icmp from any to any icmptypes 3
>##allow source quench in and out
>add 00601 allow icmp from any to any icmptypes 4
>##allow me to ping out and receive response back
>add 00602 allow icmp from any to any icmptypes 8 out
>add 00603 allow icmp from any to any icmptypes 0 in
>##allow me to run traceroute
>add 00604 allow icmp from any to any icmptypes 11 in
>#allow ident requests
>add 00700 allow tcp from any to any 113 keep-state setup
>#deny syn and fin bits used for OS finger printing using nmap
>add 00701 deny log tcp from any to any in tcpflags syn,fin
>#log anything that falls through
>add 09000 deny log ip from any to any
>
>Kind Regards,
>Nelis


To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-questions" in the body of the message