From owner-freebsd-questions@FreeBSD.ORG  Mon May 24 08:18:10 2004
Return-Path: <owner-freebsd-questions@FreeBSD.ORG>
Delivered-To: freebsd-questions@freebsd.org
Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125])
	by hub.freebsd.org (Postfix) with ESMTP id 5B3F816A4CE
	for <freebsd-questions@freebsd.org>;
	Mon, 24 May 2004 08:18:10 -0700 (PDT)
Received: from terpsi.otenet.gr (terpsi.otenet.gr [195.170.0.9])
	by mx1.FreeBSD.org (Postfix) with ESMTP id A8A6643D46
	for <freebsd-questions@freebsd.org>;
	Mon, 24 May 2004 08:18:07 -0700 (PDT)
	(envelope-from keramida@ceid.upatras.gr)
Received: from gothmog.gr (patr530-a027.otenet.gr [212.205.215.27])
	by terpsi.otenet.gr (8.12.10/8.12.10) with ESMTP id i4OFExDr002471;
	Mon, 24 May 2004 18:15:09 +0300 (EEST)
Received: from gothmog.gr (gothmog [127.0.0.1])
	by gothmog.gr (8.12.11/8.12.11) with ESMTP id i4OE0Xtq003592;
	Mon, 24 May 2004 17:00:33 +0300 (EEST)
	(envelope-from keramida@ceid.upatras.gr)
Received: (from giorgos@localhost)
	by gothmog.gr (8.12.11/8.12.11/Submit) id i4OE0X0R003591;
	Mon, 24 May 2004 17:00:33 +0300 (EEST)
	(envelope-from keramida@ceid.upatras.gr)
Date: Mon, 24 May 2004 17:00:33 +0300
From: Giorgos Keramidas <keramida@ceid.upatras.gr>
To: "Thomas T. Veldhouse" <veldy@veldy.net>
Message-ID: <20040524140033.GA3461@gothmog.gr>
References: <20040524122957.GA47602@dogma.freebsd-uk.eu.org>
	<001501c44195$e2ac4610$321d590a@nic.target.com>
Mime-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <001501c44195$e2ac4610$321d590a@nic.target.com>
cc: Jonathon McKitrick <jcm@FreeBSD-uk.eu.org>
cc: freebsd-questions@freebsd.org
Subject: Re: Repeated connections to port 25 with firewall
X-BeenThere: freebsd-questions@freebsd.org
X-Mailman-Version: 2.1.1
Precedence: list
List-Id: User questions <freebsd-questions.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-questions>,
	<mailto:freebsd-questions-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-questions>
List-Post: <mailto:freebsd-questions@freebsd.org>
List-Help: <mailto:freebsd-questions-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-questions>,
	<mailto:freebsd-questions-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Mon, 24 May 2004 15:18:10 -0000

On 2004-05-24 08:49, "Thomas T. Veldhouse" <veldy@veldy.net> wrote:
> From: "Jonathon McKitrick" <jcm@FreeBSD-uk.eu.org>
> >
> > This is probably a simple question with a simple answer, but I
> > wasn't sure where to look.
[snip]
> You should allow all traffic on your loopback device by default.
> Much like this (for IPFILTER)
>
> pass in quick on lo0 all
> pass out quick on lo0 all

Very true.  I do prefer writing this to explicitly allow only packets
from/to 127.0.0.1/32 though:

	IPFW syntax
	-----------
	add allow ip from 127.0.0.1/32 to 127.0.0.1/32 via lo0
	add deny ip from 127.0.0.0/8 to any
	add deny ip from any to 127.0.0.0/8

	ipfilter syntax
	---------------
	block in from any to any
	block out from any to any
	pass in quick from 127.0.0.1/32 to 127.0.0.1/32 on lo0
	pass out quick from 127.0.0.1/32 to 127.0.0.1/32 on lo0

I've even been tempted to try blocking everything on lo0 and explicitly
allowing only a few selected ports/protocols.  But that's paranoid :-P

- Giorgos