From owner-freebsd-questions@FreeBSD.ORG Sat Feb 14 18:14:39 2004 Return-Path: Delivered-To: freebsd-questions@freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id 6FE2016A4CE for ; Sat, 14 Feb 2004 18:14:39 -0800 (PST) Received: from radicalv.com (secure.radicalv.com [216.118.91.10]) by mx1.FreeBSD.org (Postfix) with SMTP id 17B8B43D1D for ; Sat, 14 Feb 2004 18:14:39 -0800 (PST) (envelope-from ecrist@adtechintegrated.com) Received: (qmail 64852 invoked from network); 15 Feb 2004 02:14:29 -0000 Received: from unknown (HELO localhost.invalid) (63.228.14.245) by mail.radicalv.com with SMTP; 15 Feb 2004 02:14:29 -0000 From: Eric F Crist Organization: AdTech Integrated Systems, Inc To: Erik Trulsson Date: Sat, 14 Feb 2004 20:14:29 -0600 User-Agent: KMail/1.6 References: <20040214233615.GB38665@users.munk.nu> <200402142001.13194.ecrist@adtechintegrated.com> <20040215020913.GA56178@falcon.midgard.homeip.net> In-Reply-To: <20040215020913.GA56178@falcon.midgard.homeip.net> MIME-Version: 1.0 Content-Type: multipart/signed; protocol="application/pgp-signature"; micalg=pgp-sha1; boundary="Boundary-02=_NYtLAa9orOLWKnp"; charset="iso-8859-1" Content-Transfer-Encoding: 7bit Message-Id: <200402142014.37581.ecrist@adtechintegrated.com> cc: Jez Hancock cc: freebsd-questions@freebsd.org Subject: Re: continued IPFW issues... (actually a lack of ability on my part) X-BeenThere: freebsd-questions@freebsd.org X-Mailman-Version: 2.1.1 Precedence: list Reply-To: ecrist@adtechintegrated.com List-Id: User questions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 15 Feb 2004 02:14:39 -0000 --Boundary-02=_NYtLAa9orOLWKnp Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable Content-Disposition: inline On Saturday 14 February 2004 08:09 pm, Erik Trulsson wrote: > On Sat, Feb 14, 2004 at 08:01:07PM -0600, Eric F Crist wrote: > > My bad, I found the log entry after your prodding. After enabling > > logging in the ruleset and enabling the sysctl variable, I get the > > following output in a tail /var/log/security: > > > > Feb 14 19:59:44 grog kernel: ipfw: 65534 Deny UDP 192.168.0.1:51598 > > 255.255.255.255:61112 in via dc0 > > Feb 14 19:59:45 grog kernel: ipfw: 65534 Deny UDP 204.147.80.1:53 > > 63.228.14.241:49152 in via dc0 > > Feb 14 19:59:46 grog kernel: ipfw: 65534 Deny UDP 204.127.202.4:53 > > 63.228.14.241:49152 in via dc0 > > Feb 14 19:59:50 grog kernel: ipfw: 65534 Deny UDP 192.168.0.1:51599 > > 255.255.255.255:61112 in via dc0 > > Feb 14 19:59:55 grog kernel: ipfw: 65534 Deny UDP 204.127.202.4:53 > > 63.228.14.241:49152 in via dc0 > > Feb 14 19:59:56 grog kernel: ipfw: 65534 Deny UDP 192.168.0.1:51600 > > 255.255.255.255:61112 in via dc0 > > Feb 14 19:59:59 grog kernel: ipfw: 65534 Deny UDP 204.147.80.5:53 > > 63.228.14.241:49152 in via dc0 > > Feb 14 20:00:02 grog kernel: ipfw: 65534 Deny UDP 204.147.80.5:53 > > 63.228.14.241:49152 in via dc0 > > Feb 14 20:00:02 grog kernel: ipfw: 65534 Deny UDP 192.168.0.1:51601 > > 255.255.255.255:61112 in via dc0 > > Feb 14 20:00:03 grog kernel: ipfw: 65534 Deny UDP 204.147.80.1:53 > > 63.228.14.241:49152 in via dc0 > > > > I would assume I need to enable a rule such as: > > > > ipfw add allow udp from any to me 53 > > > > Is this correct? TIA > > I don't think so. > The entries of the form 'Deny UDP 204.147.80.1:53 63.228.14.241:49152 > in via dc0' would appear to be replies to your DNS queries. > They go to the port from which the DNS query was sent (49152 in this > case). > > You need to make sure that you allow replies to connections you > initiate to get through. > > Take a look at the check-state/established/keepstate stuff people have > repeatedly told you to use. They are probably what you want. Well, from what I understand, isn't udp a state-less protocol? How would=20 established/keepstate/check-state work with that? =2D-=20 Eric F Crist AdTech Integrated Systems, Inc (612) 998-3588 --Boundary-02=_NYtLAa9orOLWKnp Content-Type: application/pgp-signature Content-Description: signature -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.4 (FreeBSD) iD8DBQBALtYNzdyDbTMRQIYRAkzMAKCIUfxZEXkRXGkKFBL1Nt71nNoqUACeJE5v EwKyEwoMpsoXru++KqvgJT4= =ht03 -----END PGP SIGNATURE----- --Boundary-02=_NYtLAa9orOLWKnp--