From owner-freebsd-security  Thu Dec 27  3:34:24 2001
Delivered-To: freebsd-security@freebsd.org
Received: from dot.ru (www.dot.ru [195.14.48.5])
	by hub.freebsd.org (Postfix) with ESMTP id 22ED637B416
	for <security@FreeBSD.ORG>; Thu, 27 Dec 2001 03:34:19 -0800 (PST)
Received: from there (ugol.dot.ru [213.128.193.142])
	by dot.ru (8.10.1/8.10.1) with SMTP id fBRCeii15967
	for <security@FreeBSD.ORG>; Thu, 27 Dec 2001 15:40:47 +0300
Content-Type: text/plain;
  charset="koi8-r"
From: Yury XTC <xtc@norilsk.net>
Reply-To: xtc@norilsk.net
Organization: WDA Norilsk.NET
Message-Id: <200112271424.2161@XTC.NORILSK.NET>
To: security@FreeBSD.ORG
Subject: Re: Help with ipfw rules to allow DNS queries through
Date: Thu, 27 Dec 2001 14:33:54 +0300
X-Mailer: KMail [version 1.3.2]
References: <2E8E747BA4D4994CB49D56AF57F1728208B2F7@adv.KOSTASOFT.kostasoft.spb.ru>
In-Reply-To: <2E8E747BA4D4994CB49D56AF57F1728208B2F7@adv.KOSTASOFT.kostasoft.spb.ru>
XTC-Mail: 3246163399
MIME-Version: 1.0
Content-Transfer-Encoding: quoted-printable
Sender: owner-freebsd-security@FreeBSD.ORG
Precedence: bulk
List-ID: <freebsd-security.FreeBSD.ORG>
List-Archive: <http://docs.freebsd.org/mail/> (Web Archive)
List-Help: <mailto:majordomo@FreeBSD.ORG?subject=help> (List Instructions)
List-Subscribe: <mailto:majordomo@FreeBSD.ORG?subject=subscribe%20freebsd-security>
List-Unsubscribe: <mailto:majordomo@FreeBSD.ORG?subject=unsubscribe%20freebsd-security>
X-Loop: FreeBSD.org

> UDP is connectionless transport protocol, isn't it?
> Just add two lines which allow you access to EXT DNS, the rest must wor=
k
> fine.
>
> ${fwcmd} add pass udp from ${ip} to any 53
> ${fwcmd} add pass udp from any 53 to ${ip}
>
> Furthermore, You can restrict the list of DNS'es. Replace ANY by explic=
it
> addresses...
>

Hey! You forget what DNS worked over TCP and UDP
try this:

add allow udp from any to ${ip} 53 in recv xl0
add allow tcp from any to ${ip} 53 setup keep-state
add allow udp from any to any out


As help go to http://www.onlamp.com/pub/ct/15
Read the articles:
  Monitoring IPFW Logs
  IPFW Logging
  BSD Firewalls: Fine-Tuning Rulesets
  BSD Firewalls: IPFW Rulesets
  BSD Firewalls: IPFW

--=20
Bast regards
Yury XTC Voloshin                    xtc@norilsk.net
Info-portal of Norilsk town       http://norilsk.net

To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-security" in the body of the message