Date: Mon, 27 Jul 1998 00:55:00 -0700 (PDT) From: "Jan B. Koum " <jkb@best.com> To: Jesse <j@lumiere.net> Cc: freebsd-security@FreeBSD.ORG Subject: Re: ipfw rules to allow DNS activity Message-ID: <Pine.BSF.3.96.980727005011.23978A-100000@shell6.ba.best.com> In-Reply-To: <Pine.BSF.3.96.980727001106.118A-100000@leaf.lumiere.net>
next in thread | previous in thread | raw e-mail | index | archive | help
Take a look at /etc/rc.firewall:
# Allow DNS queries out in the world
ipfw add pass udp from any 53 to ${ip}
ipfw add pass udp from ${ip} to any 53
You will need to enable same setup as above but for tcp for zone
transfers (someone correct me if I am wrong).
Also take a look at FreeBSD ipfw Configuration Page:
http://www.metronet.com/~pgilley/freebsd/ipfw
-- Yan
Jan Koum jkb@best.com | "Turn up the lights; I don't want
www.FreeBSD.org -- The Power to Serve | to go home in the dark."
"Write longer sentences - they are paying us a lot of money"
On Mon, 27 Jul 1998, Jesse wrote:
>
>Hi,
>
>I'm thinking of changing one of my boxes which is running bind (performing
>primary secondary DNS functions) from
>allow-anything-except-things-specifically-denied ipfw rules to
>deny-everything-except-things-specifically-allowed rules (open vs closed?
>hehe). Anyway, I was wondering what are the minimum rules necessary to
>allow DNS queries/transfers from other servers to my server, and also to
>allow queries from my server to other servers.
>
>I tried a variety of rules from the rc.firewall file, but it's still
>blocking some traffic, so there must be something I'm missing.
>
>Thanks! :)
>
>---
>Jesse <j@lumiere.net>
>http://www.lumiere.net/
>
>
>To Unsubscribe: send mail to majordomo@FreeBSD.org
>with "unsubscribe security" in the body of the message
>
To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe security" in the body of the message
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?Pine.BSF.3.96.980727005011.23978A-100000>