From owner-freebsd-questions Sun Jan 13 11:59: 8 2002 Delivered-To: freebsd-questions@freebsd.org Received: from tomts16-srv.bellnexxia.net (tomts16.bellnexxia.net [209.226.175.4]) by hub.freebsd.org (Postfix) with ESMTP id E181C37B405 for ; Sun, 13 Jan 2002 11:58:58 -0800 (PST) Received: from prayforwind.com ([64.231.164.72]) by tomts16-srv.bellnexxia.net (InterMail vM.4.01.03.16 201-229-121-116-20010115) with ESMTP id <20020113195857.OTNO22000.tomts16-srv.bellnexxia.net@prayforwind.com>; Sun, 13 Jan 2002 14:58:57 -0500 Received: from prayforwind.com (localhost [127.0.0.1]) by prayforwind.com (8.11.6/8.11.6) with ESMTP id g0DJwvF01212; Sun, 13 Jan 2002 14:58:57 -0500 (EST) (envelope-from freebsd@prayforwind.com) Message-ID: <3C41E6FF.7020108@prayforwind.com> Date: Sun, 13 Jan 2002 14:58:55 -0500 From: Steve Brown User-Agent: Mozilla/5.0 (X11; U; FreeBSD i386; en-US; rv:0.9.6) Gecko/20011222 X-Accept-Language: en-us MIME-Version: 1.0 To: freebsd-questions@freebsd.org Subject: Dru's Onlamp article on IPFW rulesets Content-Type: text/plain; charset=us-ascii; format=flowed Content-Transfer-Encoding: 7bit Sender: owner-freebsd-questions@FreeBSD.ORG Precedence: bulk List-ID: List-Archive: (Web Archive) List-Help: (List Instructions) List-Subscribe: List-Unsubscribe: X-Loop: FreeBSD.ORG Hi Dru, or anyone who can help me out please? I'm still completely blocked from the internet after applying the ruleset in the following article: http://www.onlamp.com/pub/a/bsd/2001/05/09/FreeBSD_Basics.html I got through the previous article http://www.onlamp.com/pub/a/bsd/2001/04/25/FreeBSD_Basics.html just fine. In order to get back on internet at all I keep having to comment out my kernel & rc.conf firewall options and re-compiling my kernel; it's getting frustrating. Can anyone tell me what I'm doing wrong? Here's my kernel options, rc.conf options, ipfw.rules. I'm using FreeBSD4.4-RELEASE and I've not modified /etc/rc.firewall. I'm using DHCP from a BB router which is connected to DSL ################# Kernel options####################### options IPFIREWALL options IPFIREWALL_VERBOSE options IPFIREWALL_VERBOSE_LIMIT=10 options IPSTEALTH # Hide from traceroute # To hide from nmap, don't use if running web server (I am doing so) # options TCP_DROP_SYNFIN # # To hide from portscans. causes "config MYKERNEL" # # to display "unknown option" error on my system # # options TCP_RESTRICT_RST ################# rc.conf additions ################### firewall_enable="YES" firewall_script="/etc/rc.firewall" firewall_type="/etc/ipfw.rules" firewall_quiet="NO" #change to YES once happy with rules firewall_logging_enable="YES"log_in_vain="YES" tcp_drop_synfin="NO" #change to YES if no webserver # tcp_restrict_rst="YES" icmp_drop_redirect="YES" #################### ipfw.rules ###################### # allow tcp/ip outgoing, and appropriate answerback's add 00300 check-state add 00301 deny tcp from any to any in established add 00302 allow tcp from any to any out setup keep-state # allow DNS add 0400 allow udp from 209.226.175.223 53 to any in recv vr0 add 0401 allow udp from 198.235.216.134 53 to any in recv vr0 add 0402 allow udp from 207.236.176.9 53 to any in recv vr0 add 0403 allow udp from 198.235.216.111 53 to any in recv vr0 add 0404 allow udp from 207.236.176.10 53 to any in recv vr0 add 0405 allow udp from 198.235.216.112 53 to any in recv vr0 add 0406 allow udp from 209.197.128.2 53 to any in recv vr0 add 0407 allow udp from 209.197.128.5 53 to any in recv vr0 add 00409 allow udp from any to any out To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-questions" in the body of the message