From owner-freebsd-security  Wed Feb 27 14:27:48 2002
Delivered-To: freebsd-security@freebsd.org
Received: from pi.yip.org (pi.yip.org [199.45.111.121])
	by hub.freebsd.org (Postfix) with ESMTP id B9C1837B400
	for <freebsd-security@FreeBSD.ORG>; Wed, 27 Feb 2002 14:27:45 -0800 (PST)
Received: (from melange@localhost)
	by pi.yip.org (8.11.3/8.11.3) id g1RMRjW28818
	for freebsd-security@FreeBSD.ORG; Wed, 27 Feb 2002 17:27:45 -0500 (EST)
	(envelope-from melange@yip.org)
Date: Wed, 27 Feb 2002 17:27:45 -0500
From: Bob K <melange@yip.org>
To: freebsd-security@FreeBSD.ORG
Subject: Re: allowing icmp still doesn't allow traceroute
Message-ID: <20020227172744.L40253@yip.org>
References: <20020227170928.A54682@cowbert.2y.net> <20020227172238.K40253@yip.org>
Mime-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
User-Agent: Mutt/1.2.5i
In-Reply-To: <20020227172238.K40253@yip.org>; from melange@yip.org on Wed, Feb 27, 2002 at 05:22:39PM -0500
Sender: owner-freebsd-security@FreeBSD.ORG
Precedence: bulk
List-ID: <freebsd-security.FreeBSD.ORG>
List-Archive: <http://docs.freebsd.org/mail/> (Web Archive)
List-Help: <mailto:majordomo@FreeBSD.ORG?subject=help> (List Instructions)
List-Subscribe: <mailto:majordomo@FreeBSD.ORG?subject=subscribe%20freebsd-security>
List-Unsubscribe: <mailto:majordomo@FreeBSD.ORG?subject=unsubscribe%20freebsd-security>
X-Loop: FreeBSD.org

On Wed, Feb 27, 2002 at 05:22:39PM -0500, Bob K wrote:
> On Wed, Feb 27, 2002 at 05:09:28PM -0500, Peter C. Lai wrote:
> > I have:
> > 00600 allow icmp from any to any
> > 
> > for ipfw, and i still get sendto Permission denied when
> > I try to traceroute.
> > 
> > I later also explicitly defined icmptypes 0,3,8,11,13
> > and this does not solve the problem.
> > 
> > any suggestions?
> 
> Add a rule such as this one:
> 
> add <number> unreach port udp from any to any 33434-33524 in recv <iface>

Sigh, didn't read closely enough, sorry.  That'll allow other people to
traceroute to you.  You want to allow UDP packets in that above range
leaving your machine - this should do it:

allow udp from any to any 33434-33524 out xmit <iface>

(the "out xmit <iface>" part is optional, depending on the rest of your
rules)

-- 
Bob <melange@yip.org> | It's pretty good, if you don't think about it.

To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-security" in the body of the message