From owner-freebsd-questions@FreeBSD.ORG Fri Oct 31 17:27:42 2008 Return-Path: Delivered-To: freebsd-questions@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34]) by hub.freebsd.org (Postfix) with ESMTP id E97431065673 for ; Fri, 31 Oct 2008 17:27:42 +0000 (UTC) (envelope-from freebsd-questions-local@be-well.ilk.org) Received: from mail8.sea5.speakeasy.net (mail8.sea5.speakeasy.net [69.17.117.10]) by mx1.freebsd.org (Postfix) with ESMTP id BEA798FC13 for ; Fri, 31 Oct 2008 17:27:42 +0000 (UTC) (envelope-from freebsd-questions-local@be-well.ilk.org) Received: (qmail 9997 invoked from network); 31 Oct 2008 17:27:42 -0000 Received: from dsl092-078-145.bos1.dsl.speakeasy.net (HELO be-well.ilk.org) ([66.92.78.145]) (envelope-sender ) by mail8.sea5.speakeasy.net (qmail-ldap-1.03) with SMTP for ; 31 Oct 2008 17:27:42 -0000 Received: by be-well.ilk.org (Postfix, from userid 1147) id 0560E5082C; Fri, 31 Oct 2008 13:27:40 -0400 (EDT) To: Jeremy Chadwick References: <367168.61424.qm@web56806.mail.re3.yahoo.com> <490A4487.8020101@gmail.com> <20081030233933.GB16747@icarus.home.lan> <448ws4da2f.fsf@be-well.ilk.org> <20081031160949.GA36045@icarus.home.lan> <444p2sd8od.fsf@be-well.ilk.org> <20081031170345.GA36712@icarus.home.lan> From: Lowell Gilbert Date: Fri, 31 Oct 2008 13:27:40 -0400 In-Reply-To: <20081031170345.GA36712@icarus.home.lan> (Jeremy Chadwick's message of "Fri\, 31 Oct 2008 10\:03\:45 -0700") Message-ID: <44iqr8broz.fsf@be-well.ilk.org> User-Agent: Gnus/5.11 (Gnus v5.11) Emacs/22.2 (berkeley-unix) MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Cc: Freebsd questions Subject: Re: Firewalls in FreeBSD? X-BeenThere: freebsd-questions@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: User questions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 31 Oct 2008 17:27:43 -0000 Jeremy Chadwick writes: > On Fri, Oct 31, 2008 at 12:35:30PM -0400, Lowell Gilbert wrote: >> Okay, I guess I'm a little confused by the line about "ONLY allow data >> back on these ports IF the windows box has established the connection >> out first then deny everything else." I read that as saying that the >> Windows box had sent a packet on the same connection (4-tuple, at >> least) that should be later accepted heading *to* the Windows box. >> That's just a stateful rule, and it seems to be at odds with what you >> wrote in your first message in the thread. The apparent disagreement >> was why I said anything in the first place; it sounds like there's >> more than one model of how the game works. > > I understand the confusion. Here's the actual protocol that the game > appears to be using (since the OP has stated forwarding a port range to > his LAN PC solves the problem -- meaning, his original description of > how the game protocol worked is accurate): I see. If that is the case, then the word "connection" in the line I quoted from Jack Barnett does *not* mean a TCP session, but something a little more nebulous. "Game session" might cover it. [I *was* aware of that possible confusion, which was why I specified an address/port tuple as the definition of "connection."] Sorry for the distraction; I see that (short of a deep-inspection snooping of the protocol), what has already been done is as good as you can get. -- Lowell Gilbert, embedded/networking software engineer, Boston area http://be-well.ilk.org/~lowell/