Date: Sun, 13 Jan 2002 16:38:15 -0500 From: Steve Brown <freebsd@prayforwind.com> To: Dru <genisis@istar.ca>, freebsd-questions <freebsd-questions@freebsd.org> Subject: Re: Dru's Onlamp article on IPFW rulesets Message-ID: <3C41FE47.8010407@prayforwind.com> References: <20020113152814.D92561-100000@x1-6-00-50-ba-de-36-33.kico1.on.home.com>
next in thread | previous in thread | raw e-mail | index | archive | help
Hey thanks Dru, looks like I lucked out Here's what I get. I suspect the 1'st 3 lines causing trouble, they're in rc.firewall. But what do I do about it? 00100 0 0 allow ip from any to any via lo0 00200 0 0 deny ip from any to 127.0.0.0/8 00300 0 0 deny ip from 127.0.0.0/8 to any 00300 0 0 check-state 00301 0 0 deny tcp from any to any in established 00302 0 0 allow tcp from any to any keep-state out setup 00400 0 0 allow udp from 209.226.175.223 53 to any in recv vr0 00401 0 0 allow udp from 198.235.216.134 53 to any in recv vr0 00402 0 0 allow udp from 207.236.176.9 53 to any in recv vr0 00403 0 0 allow udp from 198.235.216.111 53 to any in recv vr0 00404 0 0 allow udp from 207.236.176.10 53 to any in recv vr0 00405 0 0 allow udp from 198.235.216.112 53 to any in recv vr0 00406 0 0 allow udp from 209.197.128.2 53 to any in recv vr0 00407 0 0 allow udp from 209.197.128.5 53 to any in recv vr0 00409 20 1260 allow udp from any to any out 65535 21 4059 deny ip from any to any Thanks, Steve Dru wrote: > > On Sun, 13 Jan 2002, Steve Brown wrote: > > >>Hi Dru, or anyone who can help me out please? >> >>I'm still completely blocked from the internet after applying the >>ruleset in the following article: >>http://www.onlamp.com/pub/a/bsd/2001/05/09/FreeBSD_Basics.html >>I got through the previous article >>http://www.onlamp.com/pub/a/bsd/2001/04/25/FreeBSD_Basics.html >>just fine. >> >>In order to get back on internet at all I keep having to comment out my >>kernel & rc.conf firewall options and re-compiling my kernel; it's >>getting frustrating. Can anyone tell me what I'm doing wrong? >> >>Here's my kernel options, rc.conf options, ipfw.rules. I'm using >>FreeBSD4.4-RELEASE and I've not modified /etc/rc.firewall. I'm using >>DHCP from a BB router which is connected to DSL >> >>################# Kernel options####################### >>options IPFIREWALL >>options IPFIREWALL_VERBOSE >>options IPFIREWALL_VERBOSE_LIMIT=10 >>options IPSTEALTH # Hide from traceroute >># To hide from nmap, don't use if running web server (I am doing so) >># options TCP_DROP_SYNFIN >># # To hide from portscans. causes "config MYKERNEL" >># # to display "unknown option" error on my system >># # options TCP_RESTRICT_RST >> >>################# rc.conf additions ################### >> >>firewall_enable="YES" >>firewall_script="/etc/rc.firewall" >>firewall_type="/etc/ipfw.rules" >>firewall_quiet="NO" #change to YES once happy with rules >>firewall_logging_enable="YES"log_in_vain="YES" >>tcp_drop_synfin="NO" #change to YES if no webserver >># tcp_restrict_rst="YES" >>icmp_drop_redirect="YES" >> >>#################### ipfw.rules ###################### >># allow tcp/ip outgoing, and appropriate answerback's >>add 00300 check-state >>add 00301 deny tcp from any to any in established >>add 00302 allow tcp from any to any out setup keep-state >> >># allow DNS >>add 0400 allow udp from 209.226.175.223 53 to any in recv vr0 >>add 0401 allow udp from 198.235.216.134 53 to any in recv vr0 >>add 0402 allow udp from 207.236.176.9 53 to any in recv vr0 >>add 0403 allow udp from 198.235.216.111 53 to any in recv vr0 >>add 0404 allow udp from 207.236.176.10 53 to any in recv vr0 >>add 0405 allow udp from 198.235.216.112 53 to any in recv vr0 >>add 0406 allow udp from 209.197.128.2 53 to any in recv vr0 >>add 0407 allow udp from 209.197.128.5 53 to any in recv vr0 >> >>add 00409 allow udp from any to any out >> > > Hi Steve, > > What's the output of "ipfw show"? > > Dru > > To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-questions" in the body of the message
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?3C41FE47.8010407>