From owner-freebsd-security Thu Nov 30 7:44:24 2000 Delivered-To: freebsd-security@freebsd.org Received: from ringworld.nanolink.com (pool73-tch-1.Sofia.0rbitel.net [212.95.170.73]) by hub.freebsd.org (Postfix) with SMTP id 26A3337B400 for ; Thu, 30 Nov 2000 07:44:21 -0800 (PST) Received: (qmail 16499 invoked by uid 1000); 30 Nov 2000 15:43:44 -0000 Date: Thu, 30 Nov 2000 17:43:44 +0200 From: Peter Pentchev To: freebsd-security@FreeBSD.org Subject: Re: FreeBSD Firewall - Help please Message-ID: <20001130174344.F9269@ringworld.oblivion.bg> Mail-Followup-To: freebsd-security@FreeBSD.org References: <017801c05ac5$cafd02d0$3cfdf2c8@nirvana> <20001130152521.B9269@ringworld.oblivion.bg> <3A26643D.E0CCD8FD@algroup.co.uk> <20001130163937.D9269@ringworld.oblivion.bg> <200011301539.KAA29269@khavrinen.lcs.mit.edu> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline User-Agent: Mutt/1.2.5i In-Reply-To: <200011301539.KAA29269@khavrinen.lcs.mit.edu>; from wollman@khavrinen.lcs.mit.edu on Thu, Nov 30, 2000 at 10:39:08AM -0500 Sender: owner-freebsd-security@FreeBSD.ORG Precedence: bulk X-Loop: FreeBSD.org On Thu, Nov 30, 2000 at 10:39:08AM -0500, Garrett Wollman wrote: > < said: > > > The only way to get around this is with a stateful firewall - allowing > > UDP-source-port-53 traffic only after an outgoing UDP packet to that > > host's port 53. > > But for a lot of reasons, you're better off running a caching > nameserver on (or around) your firewall anyway. Then you don't need > to allow any DNS traffic through your filtering rules. I think the original poster was talking about configuring exactly a gateway/firewall machine. G'luck, Peter -- What would this sentence be like if it weren't self-referential? To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-security" in the body of the message