Date: Thu, 30 Nov 2000 10:39:08 -0500 (EST) From: Garrett Wollman <wollman@khavrinen.lcs.mit.edu> To: Peter Pentchev <roam@orbitel.bg> Cc: freebsd-security@FreeBSD.ORG Subject: Re: FreeBSD Firewall - Help please Message-ID: <200011301539.KAA29269@khavrinen.lcs.mit.edu> In-Reply-To: <20001130163937.D9269@ringworld.oblivion.bg> References: <017801c05ac5$cafd02d0$3cfdf2c8@nirvana> <20001130152521.B9269@ringworld.oblivion.bg> <3A26643D.E0CCD8FD@algroup.co.uk> <20001130163937.D9269@ringworld.oblivion.bg>
next in thread | previous in thread | raw e-mail | index | archive | help
<<On Thu, 30 Nov 2000 16:39:37 +0200, Peter Pentchev <roam@orbitel.bg> said: > The only way to get around this is with a stateful firewall - allowing > UDP-source-port-53 traffic only after an outgoing UDP packet to that > host's port 53. But for a lot of reasons, you're better off running a caching nameserver on (or around) your firewall anyway. Then you don't need to allow any DNS traffic through your filtering rules. -GAWollman To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-security" in the body of the message
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?200011301539.KAA29269>