From owner-freebsd-questions@FreeBSD.ORG Sat Feb 14 16:59:31 2004 Return-Path: Delivered-To: freebsd-questions@freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id 3771116A4CE for ; Sat, 14 Feb 2004 16:59:31 -0800 (PST) Received: from munk.nu (mail.munk.nu [213.152.51.194]) by mx1.FreeBSD.org (Postfix) with ESMTP id C0D0A43D2D for ; Sat, 14 Feb 2004 16:59:30 -0800 (PST) (envelope-from munk@munk.nu) Received: from munk by munk.nu with local (Exim 4.30; FreeBSD) id 1AsAd4-000DAr-0m; Sun, 15 Feb 2004 00:59:26 +0000 Date: Sun, 15 Feb 2004 00:59:25 +0000 From: Jez Hancock To: Eric F Crist Message-ID: <20040215005925.GA50495@users.munk.nu> Mail-Followup-To: Eric F Crist , 'Jez Hancock' , 'FreeBSD questions List' References: <20040214233615.GB38665@users.munk.nu> <000201c3f356$906d6010$6401a8c0@Nomad> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <000201c3f356$906d6010$6401a8c0@Nomad> User-Agent: Mutt/1.4.2i Sender: Jez Hancock cc: 'Jez Hancock' cc: 'FreeBSD questions List' Subject: Re: continued IPFW issues... (actually a lack of ability on my part) X-BeenThere: freebsd-questions@freebsd.org X-Mailman-Version: 2.1.1 Precedence: list List-Id: User questions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 15 Feb 2004 00:59:31 -0000 On Sat, Feb 14, 2004 at 05:59:14PM -0600, Eric F Crist wrote: > On Sat, Feb 14, 2004 at 03:27:35PM -0600, Eric F Crist wrote: > > I'm still having some sort of issues with ipfw rules on my server. > > I've got a > > cgi based irc client installed, and I can't connect. Also, it seems > as if my > > DNS server isn't able to send queries out. An ipfw show displays the > > following for me: > > > > 00050 54632 4640473 allow ip from me to any > > 00100 0 0 allow ip from any to any via lo0 > > 00200 0 0 deny ip from any to 127.0.0.0/8 > > 00300 0 0 deny ip from 127.0.0.0/8 to any > > 00400 4027 351563 allow ip from 63.228.14.240/29 to me > > 00500 2 80 allow ip from any to me dst-port 22 > > 00600 2 80 allow ip from any to me dst-port 21 > > 00700 388 25405 allow ip from any to me dst-port 25 > > 00800 58 4944 allow ip from any to me dst-port 80 > > 00900 2 80 allow ip from any to me dst-port 443 > > 01000 2 80 allow ip from any to me dst-port 110 > > 01100 54 4247 allow ip from any to me dst-port 53 > > 01200 2 80 allow ip from any to me dst-port 6667 > > 01300 2 80 allow ip from any to me dst-port 6668 > > 01400 4 160 deny ip from not 63.228.14.240/29 to me dst-port > 8080 > > 65535 46432 7224466 deny ip from any to any > > > > Where is all that denied traffic coming from on the final rule? > > You are only allowing traffic in and not out - as Matthew Seaman > mentioned in the last post in your previous thread, you should use > 'keep-state' to keep track of the connections made to you. See the > examples he provided in that thread. > > >From the manpage for ipfw: > > check-state > Checks the packet against the dynamic ruleset. If a match > is > found, execute the action associated with the rule which > gener- > ated this dynamic rule, otherwise move to the next rule. > Check-state rules do not have a body. If no check-state > rule is > found, the dynamic ruleset is checked at the first > keep-state or > limit rule. > > ... > > keep-state > Upon a match, the firewall will create a dynamic rule, > whose > default behaviour is to match bidirectional traffic between > source and destination IP/port using the same protocol. > The rule > has a limited lifetime (controlled by a set of sysctl(8) > vari- > ables), and the lifetime is refreshed every time a matching > packet is found. > > When a connection is made to port 80 from an external host, with the > 'keep-state' flag set on your rule for port 80 data transfer will be > allowed in both directions to/from the external host to/from you on port > 80 for a limited period. The check-state rule effectively 'shortcuts' > the rest of the rules in the ruleset if a match is made for the external > host for the given action (inbound connections to port 80 in this case). > > You'd need to do the same for each of the other ports you want to allow > free connections to/from. > > Wouldn't my first rule: > > ipfw allow ip from me to any > > have fixed this problem? Sorry I missed that rule :( How about adding a log keyword to that last deny rule temporarily just to see what exactly is being denied? -- Jez Hancock - System Administrator / PHP Developer http://munk.nu/ http://jez.hancock-family.com/ - Another FreeBSD Diary http://ipfwstats.sf.net/ - ipfw peruser traffic logging