From owner-freebsd-security Mon Jul 27 02:05:33 1998 Return-Path: Received: (from majordom@localhost) by hub.freebsd.org (8.8.8/8.8.8) id CAA05497 for freebsd-security-outgoing; Mon, 27 Jul 1998 02:05:33 -0700 (PDT) (envelope-from owner-freebsd-security@FreeBSD.ORG) Received: from verdi.nethelp.no (verdi.nethelp.no [158.36.41.162]) by hub.freebsd.org (8.8.8/8.8.8) with SMTP id CAA05483 for ; Mon, 27 Jul 1998 02:05:26 -0700 (PDT) (envelope-from sthaug@nethelp.no) From: sthaug@nethelp.no Received: (qmail 25687 invoked by uid 1001); 27 Jul 1998 09:04:56 +0000 (GMT) To: jkb@best.com Cc: j@lumiere.net, freebsd-security@FreeBSD.ORG Subject: Re: ipfw rules to allow DNS activity In-Reply-To: Your message of "Mon, 27 Jul 1998 00:55:00 -0700 (PDT)" References: X-Mailer: Mew version 1.05+ on Emacs 19.34.2 Mime-Version: 1.0 Content-Type: Text/Plain; charset=us-ascii Date: Mon, 27 Jul 1998 11:04:56 +0200 Message-ID: <25685.901530296@verdi.nethelp.no> Sender: owner-freebsd-security@FreeBSD.ORG Precedence: bulk X-Loop: FreeBSD.org > Take a look at /etc/rc.firewall: > > # Allow DNS queries out in the world > ipfw add pass udp from any 53 to ${ip} > ipfw add pass udp from ${ip} to any 53 > > You will need to enable same setup as above but for tcp for zone > transfers (someone correct me if I am wrong). Unfortunately, it's not quite that simple: - You can't know the source port in zone transfers initiated from your own name server. It won't be 53 - remember that zone transfers are performed by a separate program (named-xfer). - If you use BIND 8, the source port for queries initiated by the name server itself will *not* be 53 unless you explicitly say so. Steinar Haug, Nethelp consulting, sthaug@nethelp.no To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe security" in the body of the message