From owner-freebsd-security Mon Jul 27 01:22:33 1998 Return-Path: Received: (from majordom@localhost) by hub.freebsd.org (8.8.8/8.8.8) id BAA28879 for freebsd-security-outgoing; Mon, 27 Jul 1998 01:22:33 -0700 (PDT) (envelope-from owner-freebsd-security@FreeBSD.ORG) Received: from ns0.fast.net.uk (ns0.fast.net.uk [194.207.104.1]) by hub.freebsd.org (8.8.8/8.8.8) with ESMTP id BAA28874 for ; Mon, 27 Jul 1998 01:22:31 -0700 (PDT) (envelope-from netadmin@fastnet.co.uk) Received: from bofh.fast.net.uk (bofh.fast.net.uk [194.207.104.22]) by ns0.fast.net.uk (8.9.0/8.8.7) with ESMTP id JAA17401; Mon, 27 Jul 1998 09:22:02 +0100 (BST) Received: from localhost (localhost [127.0.0.1]) by bofh.fast.net.uk (8.8.8/8.8.5) with SMTP id JAA11275; Mon, 27 Jul 1998 09:22:03 +0100 (BST) Date: Mon, 27 Jul 1998 09:22:03 +0100 (BST) From: Jay Tribick X-Sender: netadmin@bofh.fast.net.uk To: "Jan B. Koum " cc: security@FreeBSD.ORG Subject: Re: ipfw rules to allow DNS activity In-Reply-To: Message-ID: MIME-Version: 1.0 Content-Type: TEXT/PLAIN; charset=US-ASCII Sender: owner-freebsd-security@FreeBSD.ORG Precedence: bulk X-Loop: FreeBSD.org Hi | >I'm thinking of changing one of my boxes which is running bind (performing | >primary secondary DNS functions) from | >allow-anything-except-things-specifically-denied ipfw rules to | >deny-everything-except-things-specifically-allowed rules (open vs closed? | >hehe). Anyway, I was wondering what are the minimum rules necessary to | >allow DNS queries/transfers from other servers to my server, and also to | >allow queries from my server to other servers. | >I tried a variety of rules from the rc.firewall file, but it's still | >blocking some traffic, so there must be something I'm missing. | Take a look at /etc/rc.firewall: | | # Allow DNS queries out in the world | ipfw add pass udp from any 53 to ${ip} | ipfw add pass udp from ${ip} to any 53 | | You will need to enable same setup as above but for tcp for zone | transfers (someone correct me if I am wrong). | | Also take a look at FreeBSD ipfw Configuration Page: | http://www.metronet.com/~pgilley/freebsd/ipfw AFAIK DNS zone-transfers are handled over via 53 aswell, I can't find another listing for 'Domain Name Server' in /etc/services so I assume the above will work fine. Regards, Jay Tribick -- [| Network Administrator | FastNet International | http://fast.net.uk/ |] [| Finger netadmin@fastnet.co.uk for contact information |] [| T: +44 (0)1273 677633 F: +44 (0)1273 621631 e: netadmin@fast.net.uk |] To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe security" in the body of the message