Date: Mon, 27 Jul 1998 09:22:03 +0100 (BST) From: Jay Tribick <netadmin@fastnet.co.uk> To: "Jan B. Koum " <jkb@best.com> Cc: security@FreeBSD.ORG Subject: Re: ipfw rules to allow DNS activity Message-ID: <Pine.BSF.3.96.980727092023.11044J-100000@bofh.fast.net.uk> In-Reply-To: <Pine.BSF.3.96.980727005011.23978A-100000@shell6.ba.best.com>
next in thread | previous in thread | raw e-mail | index | archive | help
Hi
| >I'm thinking of changing one of my boxes which is running bind (performing
| >primary secondary DNS functions) from
| >allow-anything-except-things-specifically-denied ipfw rules to
| >deny-everything-except-things-specifically-allowed rules (open vs closed?
| >hehe). Anyway, I was wondering what are the minimum rules necessary to
| >allow DNS queries/transfers from other servers to my server, and also to
| >allow queries from my server to other servers.
| >I tried a variety of rules from the rc.firewall file, but it's still
| >blocking some traffic, so there must be something I'm missing.
| Take a look at /etc/rc.firewall:
|
| # Allow DNS queries out in the world
| ipfw add pass udp from any 53 to ${ip}
| ipfw add pass udp from ${ip} to any 53
|
| You will need to enable same setup as above but for tcp for zone
| transfers (someone correct me if I am wrong).
|
| Also take a look at FreeBSD ipfw Configuration Page:
| http://www.metronet.com/~pgilley/freebsd/ipfw
AFAIK DNS zone-transfers are handled over via 53 aswell, I can't find
another listing for 'Domain Name Server' in /etc/services so I assume
the above will work fine.
Regards,
Jay Tribick
--
[| Network Administrator | FastNet International | http://fast.net.uk/ |]
[| Finger netadmin@fastnet.co.uk for contact information |]
[| T: +44 (0)1273 677633 F: +44 (0)1273 621631 e: netadmin@fast.net.uk |]
To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe security" in the body of the message
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?Pine.BSF.3.96.980727092023.11044J-100000>