From owner-freebsd-security Mon Jul 27 00:55:31 1998 Return-Path: Received: (from majordom@localhost) by hub.freebsd.org (8.8.8/8.8.8) id AAA25472 for freebsd-security-outgoing; Mon, 27 Jul 1998 00:55:31 -0700 (PDT) (envelope-from owner-freebsd-security@FreeBSD.ORG) Received: from shell6.ba.best.com (jkb@shell6.ba.best.com [206.184.139.137]) by hub.freebsd.org (8.8.8/8.8.8) with ESMTP id AAA25467 for ; Mon, 27 Jul 1998 00:55:27 -0700 (PDT) (envelope-from jkb@best.com) Received: from localhost (jkb@localhost) by shell6.ba.best.com (8.9.0/8.9.0/best.sh) with SMTP id AAA24929; Mon, 27 Jul 1998 00:55:00 -0700 (PDT) X-Authentication-Warning: shell6.ba.best.com: jkb owned process doing -bs Date: Mon, 27 Jul 1998 00:55:00 -0700 (PDT) From: "Jan B. Koum " X-Sender: jkb@shell6.ba.best.com To: Jesse cc: freebsd-security@FreeBSD.ORG Subject: Re: ipfw rules to allow DNS activity In-Reply-To: Message-ID: MIME-Version: 1.0 Content-Type: TEXT/PLAIN; charset=US-ASCII Sender: owner-freebsd-security@FreeBSD.ORG Precedence: bulk X-Loop: FreeBSD.org Take a look at /etc/rc.firewall: # Allow DNS queries out in the world ipfw add pass udp from any 53 to ${ip} ipfw add pass udp from ${ip} to any 53 You will need to enable same setup as above but for tcp for zone transfers (someone correct me if I am wrong). Also take a look at FreeBSD ipfw Configuration Page: http://www.metronet.com/~pgilley/freebsd/ipfw -- Yan Jan Koum jkb@best.com | "Turn up the lights; I don't want www.FreeBSD.org -- The Power to Serve | to go home in the dark." "Write longer sentences - they are paying us a lot of money" On Mon, 27 Jul 1998, Jesse wrote: > >Hi, > >I'm thinking of changing one of my boxes which is running bind (performing >primary secondary DNS functions) from >allow-anything-except-things-specifically-denied ipfw rules to >deny-everything-except-things-specifically-allowed rules (open vs closed? >hehe). Anyway, I was wondering what are the minimum rules necessary to >allow DNS queries/transfers from other servers to my server, and also to >allow queries from my server to other servers. > >I tried a variety of rules from the rc.firewall file, but it's still >blocking some traffic, so there must be something I'm missing. > >Thanks! :) > >--- >Jesse >http://www.lumiere.net/ > > >To Unsubscribe: send mail to majordomo@FreeBSD.org >with "unsubscribe security" in the body of the message > To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe security" in the body of the message