From owner-freebsd-security  Thu Nov 30  6:31: 4 2000
Delivered-To: freebsd-security@freebsd.org
Received: from eastwood.aldigital.algroup.co.uk (eastwood.aldigital.algroup.co.uk [194.128.162.193])
	by hub.freebsd.org (Postfix) with ESMTP id EF25B37B401
	for <freebsd-security@FreeBSD.ORG>; Thu, 30 Nov 2000 06:31:01 -0800 (PST)
Received: from algroup.co.uk ([192.168.192.1]) by eastwood.aldigital.algroup.co.uk (8.8.8/8.6.12) with ESMTP id OAA14546; Thu, 30 Nov 2000 14:30:21 GMT
Message-ID: <3A26643D.E0CCD8FD@algroup.co.uk>
Date: Thu, 30 Nov 2000 14:29:17 +0000
From: Adam Laurie <adam@algroup.co.uk>
X-Mailer: Mozilla 4.7 [en-gb] (Win98; I)
X-Accept-Language: en
MIME-Version: 1.0
To: Peter Pentchev <roam@orbitel.bg>
Cc: "Roberto Samarone Araujo (RSA)" <sama@supridad.com.br>,
	freebsd-security@FreeBSD.ORG
Subject: Re: FreeBSD Firewall - Help please
References: <017801c05ac5$cafd02d0$3cfdf2c8@nirvana> <20001130152521.B9269@ringworld.oblivion.bg>
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit
Sender: owner-freebsd-security@FreeBSD.ORG
Precedence: bulk
X-Loop: FreeBSD.org

Peter Pentchev wrote:
> 
> On Thu, Nov 30, 2000 at 09:05:12AM -0300, Roberto Samarone Araujo (RSA) wrote:
> > Hi,
> >
> > I've set up a FreeBSD 4.1.1 firewall that deny everything by default. I
> > opened some ports that I need but, I'm having some problems with this
> > services : DNS,FTP,POP3 and SMTP. I put this rules in order to open this
> > services but, it doesn't work.
> > Please, Help me
> 
> It looks pretty much ok, just a few remarks..
> 
> >
> > ## Allow TCP through if setup succeeded
> > $fw add pass tcp from any to any stablished
> 
> I *hope* this reads 'established', not 'stablished' ;)
> 
> > ## Allow DNS queries out in the world
> > $fw add pass udp from any 53 to $ip
> > $fw add pass udp from $ip to any
> > ## Allow DNS access to my DNS
> > $fw add pass tcp from any to $ip 53 setup
> 
> If you are running a nameserver and you want to allow the world to query
> your server, then you should allow UDP queries to port 53, not just TCP.

<yet again>
even if you're not, you don't want to allow any traffic based on source
port (see "## Allow DNS queries out in the world" rule).
</yet again>

cheers,
Adam
--
Adam Laurie                   Tel: +44 (20) 8742 0755
A.L. Digital Ltd.             Fax: +44 (20) 8742 5995
Voysey House                  http://www.thebunker.net
Barley Mow Passage            http://www.aldigital.co.uk
London W4 4GB                 mailto:adam@algroup.co.uk
UNITED KINGDOM                PGP key on keyservers


To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-security" in the body of the message