From owner-freebsd-questions@FreeBSD.ORG Fri Jul 30 14:55:59 2004 Return-Path: Delivered-To: freebsd-questions@freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id B2C6116A4CE for ; Fri, 30 Jul 2004 14:55:59 +0000 (GMT) Received: from lakermmtao07.cox.net (lakermmtao07.cox.net [68.230.240.32]) by mx1.FreeBSD.org (Postfix) with ESMTP id 20A7E43D1F for ; Fri, 30 Jul 2004 14:55:59 +0000 (GMT) (envelope-from james.coulter@cox.net) Received: from sabrina ([68.105.58.150]) by lakermmtao07.cox.net (InterMail vM.6.01.03.02.01 201-2131-111-104-103-20040709) with ESMTP id <20040730145558.FXDK6416.lakermmtao07.cox.net@sabrina> for ; Fri, 30 Jul 2004 10:55:58 -0400 From: "James A. Coulter" To: Date: Fri, 30 Jul 2004 09:55:53 -0500 Message-ID: <002801c47645$51cfcb50$6e01a8c0@sabrina> MIME-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable X-Priority: 3 (Normal) X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook, Build 10.0.6626 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1441 Importance: Normal Subject: Firewall Rule Set not allowing access to DNS servers? X-BeenThere: freebsd-questions@freebsd.org X-Mailman-Version: 2.1.1 Precedence: list List-Id: User questions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 30 Jul 2004 14:55:59 -0000 I am using FreeBSD 4.10 as a gateway/router for a small home LAN. My outside interface (dc1) is connected to a cable modem and is configured = for DHCP. I have compiled and installed a custome kernel with IPFIREWALL and = IPDIVERT options and with a rule set allowing any to any with no problems I am in the process of adding a proper rule set to provide security. I = was referred to http://freebsd.a1poweruser.com:6088/FBSD_firewall/ and = installed the Stateful + NATD Rule Set modified for my outside interface, domain = name servers, and DHCP server. I can ping IP addresses and pass SMTP mail back and forth from the gateway/router and all machines on the LAN, but I cannot ping URLs - I = am getting "ping: cannot resolve www.freebsd.org: Host name lookup failure" errors. This is what ipfw -a list looks like: sara# ipfw -a list 00005 0 0 allow ip from any to any via xl0 00010 52 3640 allow ip from any to any via lo0 00014 0 0 divert 8668 ip from any to any in recv dc1 00015 0 0 check-state 00020 0 0 skipto 800 tcp from any to 68.105.161.20 53 keep-state = out xmit dc1 setup 00021 0 0 skipto 800 tcp from any to 68.1.18.25 53 keep-state out = xmit dc1 setup 00022 0 0 skipto 800 tcp from any to 68.10.16.30 53 keep-state out xmit dc1 setup 00030 0 0 skipto 800 udp from any to 172.19.17.22 67 keep-state = out xmit dc1 00040 0 0 skipto 800 tcp from any to any 80 keep-state out xmit = dc1 setup 00050 0 0 skipto 800 tcp from any to any 443 keep-state out xmit = dc1 setup 00060 0 0 skipto 800 tcp from any to any 25 keep-state out xmit = dc1 setup 00061 0 0 skipto 800 tcp from any to any 110 keep-state out xmit = dc1 setup 00070 0 0 skipto 800 tcp from me to any uid root keep-state out = xmit dc1 setup 00080 0 0 skipto 800 icmp from any to any keep-state out xmit dc1 00090 0 0 skipto 800 tcp from any to any 37 keep-state out xmit = dc1 setup 00100 0 0 skipto 800 tcp from any to any 119 keep-state out xmit = dc1 setup 00110 0 0 skipto 800 tcp from any to any 22 keep-state out xmit = dc1 setup 00120 0 0 skipto 800 tcp from any to any 43 keep-state out xmit = dc1 setup 00130 0 0 skipto 800 udp from any to any 123 keep-state out xmit = dc1 00300 0 0 deny ip from 192.168.0.0/16 to any in recv dc1 00301 0 0 deny ip from 172.16.0.0/12 to any in recv dc1 00302 0 0 deny ip from 10.0.0.0/8 to any in recv dc1 00303 0 0 deny ip from 127.0.0.0/8 to any in recv dc1 00304 0 0 deny ip from 0.0.0.0/8 to any in recv dc1 00305 0 0 deny ip from 169.254.0.0/16 to any in recv dc1 00306 0 0 deny ip from 192.0.2.0/24 to any in recv dc1 00307 0 0 deny ip from 204.152.64.0/23 to any in recv dc1 00308 0 0 deny ip from 224.0.0.0/3 to any in recv dc1 00315 0 0 deny tcp from any to any 113 in recv dc1 00320 0 0 deny tcp from any to any 137 in recv dc1 00321 0 0 deny tcp from any to any 138 in recv dc1 00322 0 0 deny tcp from any to any 139 in recv dc1 00323 0 0 deny tcp from any to any 81 in recv dc1 00330 0 0 deny ip from any to any in recv dc1 frag 00332 0 0 deny tcp from any to any in recv dc1 established 00360 0 0 allow udp from 172.19.17.22 to any 68 keep-state in recv = dc1 00370 0 0 allow tcp from any to me 80 limit src-addr 2 in recv dc1 setup 00370 0 0 allow tcp from any to me 8888 limit src-addr 2 in recv = dc1 setup 00380 0 0 allow tcp from any to me 22 limit src-addr 2 in recv dc1 setup 00400 0 0 deny log logamount 10 ip from any to any in recv dc1 00450 81 5288 deny log logamount 10 ip from any to any out xmit dc1 00800 0 0 divert 8668 ip from any to any out xmit dc1 00801 645 59255 allow ip from any to any 00999 0 0 deny log logamount 10 ip from any to any 65535 1 347 deny ip from any to any This is what my /etc/rc.conf looks like: hostname=3D"sara.mshome.net" ifconfig_dc1=3D"DHCP" ifconfig_dc0=3D"inet 192.168.1.1 netmask 255.255.255.0" firewall_enable=3D"YES" firewall_script=3D"/etc/ipfw.rules" firewall_logging=3D"YES" kern_securelevel_enable=3D"NO" linux_enable=3D"YES" moused_enable=3D"YES" named_enable=3D"YES" nfs_client_enable=3D"YES" nfs_reserved_port_only=3D"YES" nfs_server_enable=3D"YES" sendmail_enable=3D"YES" sshd_enable=3D"YES" usbd_enable=3D"YES" ntpd_enable=3D"YES" inetd_enable=3D"YES" gateway_enable=3D"YES" natd_enable=3D"YES" natd_interface=3D"dc1" natd_flags=3D"-dynamic" Finally, this is what /etc/resolv.conf looks like: sara# more /etc/resolv.conf search pn.at.cox.net nameserver 68.105.161.20 nameserver 68.1.18.25 nameserver 68.10.16.30 Any ideas? Thanks, Jim C.