From owner-freebsd-security  Thu Aug 16 11:49:44 2001
Delivered-To: freebsd-security@freebsd.org
Received: from ren.sasknow.com (ren.sasknow.com [207.195.92.131])
	by hub.freebsd.org (Postfix) with ESMTP
	id 72BC537B401; Thu, 16 Aug 2001 11:49:35 -0700 (PDT)
	(envelope-from ryan@sasknow.com)
Received: from localhost (ryan@localhost)
	by ren.sasknow.com (8.9.3/8.9.3) with ESMTP id MAA03987;
	Thu, 16 Aug 2001 12:49:30 -0600 (CST)
	(envelope-from ryan@sasknow.com)
Date: Thu, 16 Aug 2001 12:49:30 -0600 (CST)
From: Ryan Thompson <ryan@sasknow.com>
To: default - Subscriptions <default013subscriptions@hotmail.com>
Cc: freebsd-questions@FreeBSD.ORG
Subject: Re: Quick IPFW Rule Question
In-Reply-To: <OE46K1XIOrEsmuHTY0B0000cfed@hotmail.com>
Message-ID: <Pine.BSF.4.21.0108161242590.1353-100000@ren.sasknow.com>
Organization: SaskNow Technologies [www.sasknow.com]
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
Sender: owner-freebsd-security@FreeBSD.ORG
Precedence: bulk
List-ID: <freebsd-security.FreeBSD.ORG>
List-Archive: <http://docs.freebsd.org/mail/> (Web Archive)
List-Help: <mailto:majordomo@FreeBSD.ORG?subject=help> (List Instructions)
List-Subscribe: <mailto:majordomo@FreeBSD.ORG?subject=subscribe%20freebsd-security>
List-Unsubscribe: <mailto:majordomo@FreeBSD.ORG?subject=unsubscribe%20freebsd-security>
X-Loop: FreeBSD.org


This is most appropriate for the -questions forum.
Reply sent to freebsd-questions@freebsd.org, BCC security.


default - Subscriptions wrote to freebsd-security@FreeBSD.ORG and...:

> Hi,
> 
> What would be the best rule to allow all incoming traffic from one
> specific I.P. address? (for a machine with 2 I.P.s bound to the
> NIC...)


If you mean "allow incoming traffic for an IP address bound to a NIC",
this is implicitly allowed by default.

Otherwise, to allow any incoming traffic from, say, 172.16.0.1:
ipfw add 1000 allow ip from 172.16.0.1 to any

You also need an explicit outgoing rule, if you do not allow all outgoing
traffic. That rule would be:

ipfw add 1010 allow ip from any to 172.16.0.1

To be more specific/secure, replace "any" in the above two rules with your
IP or network address.

> Also, what would be the best rule to allow all outgoing traffic from
> my local machine?

Repeat for each IP address you have bound to your NIC. The basic 
syntax is:
ipfw add #### allow ip from 10.0.0.1 to any

Where #### is a unique rule number.

Or, you can allow subnets, if appropriate in your setup:
ipfw add 3000 allow ip from 10.0.0.0/24 to any


> Thanks,
> 
> Jordan
> 
> To Unsubscribe: send mail to majordomo@FreeBSD.org
> with "unsubscribe freebsd-questions" in the body of the message
> 

-- 
  Ryan Thompson <ryan@sasknow.com>
  Network Administrator, Accounts

  SaskNow Technologies - http://www.sasknow.com
  #106-380 3120 8th St E - Saskatoon, SK - S7H 0W2

        Tel: 306-664-3600   Fax: 306-664-1161   Saskatoon
  Toll-Free: 877-727-5669     (877-SASKNOW)     North America


To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-security" in the body of the message