From owner-freebsd-security  Thu Nov 30  7:39:17 2000
Delivered-To: freebsd-security@freebsd.org
Received: from khavrinen.lcs.mit.edu (khavrinen.lcs.mit.edu [18.24.4.193])
	by hub.freebsd.org (Postfix) with ESMTP id DFCF037B401
	for <freebsd-security@FreeBSD.ORG>; Thu, 30 Nov 2000 07:39:14 -0800 (PST)
Received: (from wollman@localhost)
	by khavrinen.lcs.mit.edu (8.9.3/8.9.3) id KAA29269;
	Thu, 30 Nov 2000 10:39:08 -0500 (EST)
	(envelope-from wollman)
Date: Thu, 30 Nov 2000 10:39:08 -0500 (EST)
From: Garrett Wollman <wollman@khavrinen.lcs.mit.edu>
Message-Id: <200011301539.KAA29269@khavrinen.lcs.mit.edu>
To: Peter Pentchev <roam@orbitel.bg>
Cc: freebsd-security@FreeBSD.ORG
Subject: Re: FreeBSD Firewall - Help please
In-Reply-To: <20001130163937.D9269@ringworld.oblivion.bg>
References: <017801c05ac5$cafd02d0$3cfdf2c8@nirvana>
	<20001130152521.B9269@ringworld.oblivion.bg>
	<3A26643D.E0CCD8FD@algroup.co.uk>
	<20001130163937.D9269@ringworld.oblivion.bg>
Sender: owner-freebsd-security@FreeBSD.ORG
Precedence: bulk
X-Loop: FreeBSD.org

<<On Thu, 30 Nov 2000 16:39:37 +0200, Peter Pentchev <roam@orbitel.bg> said:

> The only way to get around this is with a stateful firewall - allowing
> UDP-source-port-53 traffic only after an outgoing UDP packet to that
> host's port 53.

But for a lot of reasons, you're better off running a caching
nameserver on (or around) your firewall anyway.  Then you don't need
to allow any DNS traffic through your filtering rules.

-GAWollman



To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-security" in the body of the message