Date: Mon, 27 Feb 2006 00:50:09 +0200 From: Giorgos Keramidas <keramida@ceid.upatras.gr> To: Roman Serbski <mefystofel@gmail.com> Cc: freebsd-questions@freebsd.org Subject: Re: Help with IP Filter 4.1.8 Message-ID: <20060226225009.GA1207@flame.pc> In-Reply-To: <cca5083b0602260715w2f4a9e49o494f2f537afca2db@mail.gmail.com> References: <cca5083b0602260715w2f4a9e49o494f2f537afca2db@mail.gmail.com>
next in thread | previous in thread | raw e-mail | index | archive | help
On 2006-02-26 20:15, Roman Serbski <mefystofel@gmail.com> wrote:
> Hi all,
>
> I am having a problem with ipf after recent upgrade to 6.1-PRERELEASE.
> Any help would be greatly appreciated.
>
> ipf: IP Filter: v4.1.8 (416)
> Kernel: IP Filter: v4.1.8
> Running: yes
> Log Flags: 0 = none set
> Default: pass all, Logging: available
> Active list: 0
> Feature mask: 0xa
>
> I am trying to allow outgoing dns requests from my server to DNS
> server of ISP. Here is my ruleset:
>
> # ipfstat -oh
> 0 pass out quick on lo0 from any to any
> 0 pass out quick on xl0 proto tcp from any to any port = domain flags S/FSRPAU keep state
> 1 pass out quick on xl0 proto udp from any to any port = domain keep state
> 0 block out log quick on xl0 all
This part seems ok. I'd probably try without the ``flags S/FSRPAU''
part, but that's relatively harmless.
> # ipfstat -ih
> 0 pass in quick on lo0 from any to any
> 0 block in quick on xl0 all
This part seems a bit paranoid, but relatively ok too.
> I tried `host www.google.com` and the connection was timed out,
> although there was a hit on a rule allowing 53/udp.
> The interesting thing is that there is another server running
> 5.3-STABLE with ipf v3.4.35 (336) and it has the same ruleset and
> everything is working just fine.
When you're having problems with IP Filter rules, it's always a good
idea to `log' the blocking rules. Can you try the following two things?
a) Remove the `flags' part of the stateful rule.
b) Add a `log' keyword to the input blocking rule.
The rulesets for these two cases would be:
# Ruleset 1.
pass out quick on lo0 from any to any
pass out quick on xl0 proto tcp from any to any port = domain keep state
pass out quick on xl0 proto udp from any to any port = domain keep state
block out log quick on xl0 all
pass in quick on lo0 from any to any
block in quick on xl0 all
# Ruleset 2.
pass out quick on lo0 from any to any
pass out quick on xl0 proto tcp from any to any port = domain keep state
pass out quick on xl0 proto udp from any to any port = domain keep state
block out log quick on xl0 all
pass in quick on lo0 from any to any
block in log quick on xl0 all
When you install the logging final rule, please check your system logs
for blocked packets. Then you'll have an idea why something is blocked,
what was blocked, etc. Post the ipfilter log messages as a followup to
this thread, and we'll try to track down the problem the current ruleset
has.
- Giorgos
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20060226225009.GA1207>