Date: Thu, 30 Nov 2000 14:29:17 +0000 From: Adam Laurie <adam@algroup.co.uk> To: Peter Pentchev <roam@orbitel.bg> Cc: "Roberto Samarone Araujo (RSA)" <sama@supridad.com.br>, freebsd-security@FreeBSD.ORG Subject: Re: FreeBSD Firewall - Help please Message-ID: <3A26643D.E0CCD8FD@algroup.co.uk> References: <017801c05ac5$cafd02d0$3cfdf2c8@nirvana> <20001130152521.B9269@ringworld.oblivion.bg>
next in thread | previous in thread | raw e-mail | index | archive | help
Peter Pentchev wrote: > > On Thu, Nov 30, 2000 at 09:05:12AM -0300, Roberto Samarone Araujo (RSA) wrote: > > Hi, > > > > I've set up a FreeBSD 4.1.1 firewall that deny everything by default. I > > opened some ports that I need but, I'm having some problems with this > > services : DNS,FTP,POP3 and SMTP. I put this rules in order to open this > > services but, it doesn't work. > > Please, Help me > > It looks pretty much ok, just a few remarks.. > > > > > ## Allow TCP through if setup succeeded > > $fw add pass tcp from any to any stablished > > I *hope* this reads 'established', not 'stablished' ;) > > > ## Allow DNS queries out in the world > > $fw add pass udp from any 53 to $ip > > $fw add pass udp from $ip to any > > ## Allow DNS access to my DNS > > $fw add pass tcp from any to $ip 53 setup > > If you are running a nameserver and you want to allow the world to query > your server, then you should allow UDP queries to port 53, not just TCP. <yet again> even if you're not, you don't want to allow any traffic based on source port (see "## Allow DNS queries out in the world" rule). </yet again> cheers, Adam -- Adam Laurie Tel: +44 (20) 8742 0755 A.L. Digital Ltd. Fax: +44 (20) 8742 5995 Voysey House http://www.thebunker.net Barley Mow Passage http://www.aldigital.co.uk London W4 4GB mailto:adam@algroup.co.uk UNITED KINGDOM PGP key on keyservers To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-security" in the body of the message
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?3A26643D.E0CCD8FD>