From owner-freebsd-isp  Mon Apr 23 12:48: 8 2001
Delivered-To: freebsd-isp@freebsd.org
Received: from virtual2.sysadmin-inc.com (ns2.sysadmin-inc.com [209.16.228.145])
	by hub.freebsd.org (Postfix) with SMTP id ECB1B37B423
	for <freebsd-isp@freebsd.org>; Mon, 23 Apr 2001 12:48:03 -0700 (PDT)
	(envelope-from peter@sysadmin-inc.com)
Received: (qmail 1640 invoked by alias); 23 Apr 2001 17:01:15 -0000
Received: from unknown (HELO w2kstest) (10.10.1.70)
  by ns2.sysadmin-inc.com with SMTP; 23 Apr 2001 17:01:15 -0000
From: "Peter Brezny" <peter@sysadmin-inc.com>
To: <freebsd-isp@freebsd.org>
Subject: dns transfer through ipfw keepstate rule not working.
Date: Mon, 23 Apr 2001 13:00:35 -0400
Message-ID: <MFEFLELMIJGKDKPCJHAFMEOOCAAA.peter@sysadmin-inc.com>
MIME-Version: 1.0
Content-Type: text/plain;
	charset="iso-8859-1"
Content-Transfer-Encoding: 7bit
X-Priority: 3 (Normal)
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook IMO, Build 9.0.2416 (9.0.2911.0)
X-MimeOLE: Produced By Microsoft MimeOLE V5.00.2919.6700
Importance: Normal
Sender: owner-freebsd-isp@FreeBSD.ORG
Precedence: bulk
X-Loop: FreeBSD.org

In a somewhat desperate attempt to convince my firewall to allow our
upstream provider to perform a zone transfer, I've added the following line
to the ipfw firewall.

        $fwcmd add allow all from 209.16.228.146 to $ns1 keep-state in via
$oif

However, this is still not allowing a zone transfer.  On occasion, the
secondary will write a file with a somewhat garbled name for the zone to be
transfered, but it is blank.

This firewall entry however, works.

        $fwcmd add allow all from 209.16.228.146 to $ns1 in via $oif
        $fwcmd add allow all from $ns1 to 209.16.228.146 out via $oif

Why doesn't the above dynamic rule work?

My rc.conf options section is as follows.

TIA,

pb

// $FreeBSD: src/etc/namedb/named.conf,v 1.6.2.1 2000/07/15 07:49:29 kris
Exp $

        options {

        directory "/etc/namedb";

        forwarders {    207.230.75.34;          //ns1.deltacom.net
                        207.230.75.50;          //ns2.deltacom.net
                        206.191.128.46;         //c2901.wa.net
                        199.166.24.1; };        //ns1.vrx.net

        allow-transfer { 209.16.228.140;        //virtual/ns2

                        207.230.75.34;          //ns1.deltacom.net
                        207.230.75.50; };       //ns2.deltacom.net


        query-source address 209.16.228.145 port 53;
        transfer-source 209.16.228.145;
        listen-on { 209.16.228.145; 209.16.228.150; };

        dump-file "s/named_dump.db";
        pid-file "s/named.pid";

};      //end of options

Peter Brezny
SysAdmin Services Inc.


To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-isp" in the body of the message