From owner-freebsd-questions@FreeBSD.ORG  Sat Apr  5 19:44:35 2003
Return-Path: <owner-freebsd-questions@FreeBSD.ORG>
Delivered-To: freebsd-questions@freebsd.org
Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125])
	by hub.freebsd.org (Postfix) with ESMTP id 3C91F37B401
	for <freebsd-questions@freebsd.org>;
	Sat,  5 Apr 2003 19:44:35 -0800 (PST)
Received: from thalia.otenet.gr (mailsrv.otenet.gr [195.170.0.5])
	by mx1.FreeBSD.org (Postfix) with ESMTP id 02A2B43FAF
	for <freebsd-questions@freebsd.org>;
	Sat,  5 Apr 2003 19:44:33 -0800 (PST)
	(envelope-from keramida@ceid.upatras.gr)
Received: from gothmog.gr (patr530-a193.otenet.gr [212.205.215.193])
	by thalia.otenet.gr (8.12.9/8.12.9) with ESMTP id h363iSfe006663;
	Sun, 6 Apr 2003 06:44:29 +0300 (EEST)
Received: from gothmog.gr (gothmog [127.0.0.1])
	by gothmog.gr (8.12.9/8.12.9) with ESMTP id h363iRt5004890;
	Sun, 6 Apr 2003 06:44:28 +0300 (EEST)
	(envelope-from keramida@ceid.upatras.gr)
Received: (from giorgos@localhost)
	by gothmog.gr (8.12.9/8.12.9/Submit) id h363Acio004510;
	Sun, 6 Apr 2003 06:10:38 +0300 (EEST)
	(envelope-from keramida@ceid.upatras.gr)
Date: Sun, 6 Apr 2003 06:10:38 +0300
From: Giorgos Keramidas <keramida@ceid.upatras.gr>
To: Robin Ericsson <lobbin@localhost.nu>
Message-ID: <20030406031038.GB4130@gothmog.gr>
References: <008d01c2fbac$86dcf710$0401a8c0@metis>
Mime-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <008d01c2fbac$86dcf710$0401a8c0@metis>
cc: freebsd-questions@freebsd.org
Subject: Re: input on ipfw rules
X-BeenThere: freebsd-questions@freebsd.org
X-Mailman-Version: 2.1.1
Precedence: list
List-Id: User questions <freebsd-questions.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-questions>,
	<mailto:freebsd-questions-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-questions>
List-Post: <mailto:freebsd-questions@freebsd.org>
List-Help: <mailto:freebsd-questions-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-questions>,
	<mailto:freebsd-questions-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Sun, 06 Apr 2003 03:44:35 -0000

On 2003-04-05 21:49, Robin Ericsson <lobbin@localhost.nu> wrote:
>
> I would like to get some input of these rules I'm currenly using.
>

> I come from a linux/cisco background, so I want to know how bad these
> are :) mostly my questions are the keep-state stuff. I guess 00235 can
> go, as I think that one allows all trafic from that specific ip if
> already connected elsewhere?

True.

> ipfw add 00230 check-state
> ipfw add 00235 allow tcp from any to any in established

You don't need both of these...  The 'established' one can safely go
away if you make it a habbit of writing rules with 'keep-state' as shown
below:

> # ssh
> ipfw add 00700 allow tcp from any to me 22 keep-state

- Giorgos