From owner-freebsd-security  Thu Nov 30  5:26: 3 2000
Delivered-To: freebsd-security@freebsd.org
Received: from ringworld.nanolink.com (pool73-tch-1.Sofia.0rbitel.net [212.95.170.73])
	by hub.freebsd.org (Postfix) with SMTP id EB67D37B400
	for <freebsd-security@FreeBSD.ORG>; Thu, 30 Nov 2000 05:25:57 -0800 (PST)
Received: (qmail 15292 invoked by uid 1000); 30 Nov 2000 13:25:22 -0000
Date: Thu, 30 Nov 2000 15:25:22 +0200
From: Peter Pentchev <roam@orbitel.bg>
To: "Roberto Samarone Araujo (RSA)" <sama@supridad.com.br>
Cc: freebsd-security@FreeBSD.ORG
Subject: Re: FreeBSD Firewall - Help please
Message-ID: <20001130152521.B9269@ringworld.oblivion.bg>
Mail-Followup-To: "Roberto Samarone Araujo (RSA)" <sama@supridad.com.br>,
	freebsd-security@FreeBSD.ORG
References: <017801c05ac5$cafd02d0$3cfdf2c8@nirvana>
Mime-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
User-Agent: Mutt/1.2.5i
In-Reply-To: <017801c05ac5$cafd02d0$3cfdf2c8@nirvana>; from sama@supridad.com.br on Thu, Nov 30, 2000 at 09:05:12AM -0300
Sender: owner-freebsd-security@FreeBSD.ORG
Precedence: bulk
X-Loop: FreeBSD.org

On Thu, Nov 30, 2000 at 09:05:12AM -0300, Roberto Samarone Araujo (RSA) wrote:
> Hi,
> 
> I've set up a FreeBSD 4.1.1 firewall that deny everything by default. I
> opened some ports that I need but, I'm having some problems with this
> services : DNS,FTP,POP3 and SMTP. I put this rules in order to open this
> services but, it doesn't work.
> Please, Help me

It looks pretty much ok, just a few remarks..

> 
> ## Allow TCP through if setup succeeded
> $fw add pass tcp from any to any stablished

I *hope* this reads 'established', not 'stablished' ;)

> ## Allow DNS queries out in the world
> $fw add pass udp from any 53 to $ip
> $fw add pass udp from $ip to any
> ## Allow DNS access to my DNS
> $fw add pass tcp from any to $ip 53 setup

If you are running a nameserver and you want to allow the world to query
your server, then you should allow UDP queries to port 53, not just TCP.

> ## Allow setup of incomming email
> $fw add pass tcp from any to $ip 25 setup
> ## Allow POP3
> $fw add pass tcp from any to $ip 106 via $if setup

POP3 is usually on port 110, not 106.

> ## Allow FTP from local network
> $fw add pass tcp from $net:$mask to $ip 20 setup
> $fw add pass tcp from $net:$mask to $ip 21 setup
> $fw add pass udp from $net:$mask to $ip 20
> $fw add pass udp from $net:$mask to $ip 21

OK, this will be OK for incoming passive-mode FTP.  Most clients still
use active-mode FTP, though, so you should also allow outgoing connections.

In any case, it would be best if you allowed outgoing connections from your
address to pretty much anywhere:

$fw add pass tcp from $ip to any setup

> # Deny everything
> $fw add 65534 deny log all from any to any

G'luck,
Peter

-- 
This sentence contains exactly threee erors.


To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-security" in the body of the message