Date: Thu, 30 Nov 2000 15:25:22 +0200 From: Peter Pentchev <roam@orbitel.bg> To: "Roberto Samarone Araujo (RSA)" <sama@supridad.com.br> Cc: freebsd-security@FreeBSD.ORG Subject: Re: FreeBSD Firewall - Help please Message-ID: <20001130152521.B9269@ringworld.oblivion.bg> In-Reply-To: <017801c05ac5$cafd02d0$3cfdf2c8@nirvana>; from sama@supridad.com.br on Thu, Nov 30, 2000 at 09:05:12AM -0300 References: <017801c05ac5$cafd02d0$3cfdf2c8@nirvana>
next in thread | previous in thread | raw e-mail | index | archive | help
On Thu, Nov 30, 2000 at 09:05:12AM -0300, Roberto Samarone Araujo (RSA) wrote: > Hi, > > I've set up a FreeBSD 4.1.1 firewall that deny everything by default. I > opened some ports that I need but, I'm having some problems with this > services : DNS,FTP,POP3 and SMTP. I put this rules in order to open this > services but, it doesn't work. > Please, Help me It looks pretty much ok, just a few remarks.. > > ## Allow TCP through if setup succeeded > $fw add pass tcp from any to any stablished I *hope* this reads 'established', not 'stablished' ;) > ## Allow DNS queries out in the world > $fw add pass udp from any 53 to $ip > $fw add pass udp from $ip to any > ## Allow DNS access to my DNS > $fw add pass tcp from any to $ip 53 setup If you are running a nameserver and you want to allow the world to query your server, then you should allow UDP queries to port 53, not just TCP. > ## Allow setup of incomming email > $fw add pass tcp from any to $ip 25 setup > ## Allow POP3 > $fw add pass tcp from any to $ip 106 via $if setup POP3 is usually on port 110, not 106. > ## Allow FTP from local network > $fw add pass tcp from $net:$mask to $ip 20 setup > $fw add pass tcp from $net:$mask to $ip 21 setup > $fw add pass udp from $net:$mask to $ip 20 > $fw add pass udp from $net:$mask to $ip 21 OK, this will be OK for incoming passive-mode FTP. Most clients still use active-mode FTP, though, so you should also allow outgoing connections. In any case, it would be best if you allowed outgoing connections from your address to pretty much anywhere: $fw add pass tcp from $ip to any setup > # Deny everything > $fw add 65534 deny log all from any to any G'luck, Peter -- This sentence contains exactly threee erors. To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-security" in the body of the message
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20001130152521.B9269>