From owner-freebsd-questions@FreeBSD.ORG Sun Nov 2 22:37:41 2014 Return-Path: Delivered-To: freebsd-questions@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [8.8.178.115]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by hub.freebsd.org (Postfix) with ESMTPS id BAA81F67 for ; Sun, 2 Nov 2014 22:37:41 +0000 (UTC) Received: from fly.hiwaay.net (fly.hiwaay.net [216.180.54.1]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (Client did not present a certificate) by mx1.freebsd.org (Postfix) with ESMTPS id 82646DF1 for ; Sun, 2 Nov 2014 22:37:41 +0000 (UTC) Received: from kabini1.local (rbn1-216-180-19-97.adsl.hiwaay.net [216.180.19.97]) (authenticated bits=0) by fly.hiwaay.net (8.13.8/8.13.8/fly) with ESMTP id sA2Mbdn5017291 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES128-SHA bits=128 verify=NO) for ; Sun, 2 Nov 2014 16:37:40 -0600 Message-ID: <5456B3AA.1050106@hiwaay.net> Date: Sun, 02 Nov 2014 16:43:54 -0600 From: "William A. Mahaffey III" User-Agent: Mozilla/5.0 (X11; FreeBSD amd64; rv:31.0) Gecko/20100101 Thunderbird/31.2.0 MIME-Version: 1.0 CC: freebsd-questions@freebsd.org Subject: Re: Minor rpc question .... References: <20141103012236.X52402@sola.nimnet.asn.au> <20141103032648.W52402@sola.nimnet.asn.au> In-Reply-To: <20141103032648.W52402@sola.nimnet.asn.au> Content-Type: text/plain; charset=windows-1252; format=flowed Content-Transfer-Encoding: 7bit X-BeenThere: freebsd-questions@freebsd.org X-Mailman-Version: 2.1.18-1 Precedence: list List-Id: User questions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 02 Nov 2014 22:37:41 -0000 On 11/02/14 11:12, Ian Smith wrote: > William, I've just seen your response at > http://lists.freebsd.org/pipermail/freebsd-questions/2014-November/262026.html > but as I take questions@ as a digest, I won't get it here till tomorrow > .. I should have asked you to cc me. > > So this is a brief hatchet job: > > > 02500 18777 23476935 allow tcp from 192.168.0.0/16 to me > > 65000 1795 424041 count ip from any to any > > 65100 1371 269257 deny { tcp or udp } from any to any dst-port 111,137,138,513 in > > > w/ port 513 obviously being denied. However, I don't know where that > > is happening :-/ & I thought rule 02500 would let all local traffic > > through .... > > /etc/rc.firewall 'workstation' ruleset allows you to enable inbound > access to services, like rwhod. see /etc/defaults/rc.conf for details > of rc.conf variables, and rc.firewall for how they're invoked. > > Rule 2500 only allows tcp, rwho is udp - but 2500 is a bit sweeping > anyway, perhaps best to enable specific services, even internally? > > Ah, yes - I see firewall_myservices and firewall_allowservices are only > for TCP services. That's a strange omission, if I'm reading it right, > especially re rpc. > > Rather than fixing this properly now for UDP services, I'd just add into > /etc/rc.firewall after what's now your 2500 or at any rate before 65000: > > ${fwcmd} allow udp from ${mynetwork} 513 to me 513 > > You're already enabling udp services outbound, statefully, which is why > you can query other hosts. Now they'll be able to reach you too :) > > 'service ipfw restart' and you should be good to go. You could remove > 513 from firewall_nologports - but now it'll already be passed by then. > > g'night, Ian > Well, I put that rule in & opened logging for that port & now I get ruptime info from other boxen, however, I also get log traffic about denied port 513 traffic: [root@kabini1, /etc, 4:34:01pm] 368 % service ipfw restart net.inet.ip.fw.enable: 1 -> 0 net.inet6.ip6.fw.enable: 1 -> 0 Flushed all rules. 00100 allow ip from any to any via lo0 00200 deny ip from any to 127.0.0.0/8 00300 deny ip from 127.0.0.0/8 to any 00400 deny ip from any to ::1 00500 deny ip from ::1 to any 00600 allow ipv6-icmp from :: to ff02::/16 00700 allow ipv6-icmp from fe80::/10 to fe80::/10 00800 allow ipv6-icmp from fe80::/10 to ff02::/16 00900 allow ipv6-icmp from any to any ip6 icmp6types 1 01000 allow ipv6-icmp from any to any ip6 icmp6types 2,135,136 01100 check-state 01200 allow tcp from me to any established 01300 allow tcp from me to any setup keep-state 01400 allow udp from me to any keep-state 01500 allow icmp from me to any keep-state 01600 allow ipv6-icmp from me to any keep-state 01700 allow udp from 0.0.0.0 68 to 255.255.255.255 dst-port 67 out 01800 allow udp from any 67 to me dst-port 68 in 01900 allow udp from any 67 to 255.255.255.255 dst-port 68 in 02000 allow udp from fe80::/10 to me dst-port 546 in 02100 allow icmp from any to any icmptypes 8 02200 allow ipv6-icmp from any to any ip6 icmp6types 128,129 02300 allow icmp from any to any icmptypes 3,4,11 02400 allow ipv6-icmp from any to any ip6 icmp6types 3 02500 allow tcp from 192.168.0.0/16 to me 02600 allow udp from 192.168.0.0/24 513 to me dst-port 513 65000 count ip from any to any 65100 deny { tcp or udp } from any to any dst-port 111,137,138 in 65200 deny { tcp or udp } from 192.168.0.0/16 to me 65300 deny ip from any to 255.255.255.255 65400 deny ip from any to 224.0.0.0/24 in 65500 deny udp from any to any dst-port 520 in 65500 deny tcp from any 80,443 to any dst-port 1024-65535 in 65500 deny log logamount 5000 ip from any to any Firewall rules loaded. [root@kabini1, /etc, 4:34:03pm] 369 % [root@kabini1, /etc, 4:37:13pm] 337 % ( tail -20 /var/log/security ; date ) Oct 30 11:00:00 kabini1 newsyslog[9861]: logfile turned over due to size>100K Oct 30 11:00:30 kabini1 kernel: ipfw: 65500 Deny UDP 92.108.103.99:58507 192.168.0.27:63167 in via re0 Oct 30 11:00:49 kabini1 kernel: ipfw: 65500 Deny P:2 192.168.0.27 224.0.0.22 out via re0 Oct 30 11:00:52 kabini1 kernel: ipfw: 65500 Deny P:2 192.168.0.27 224.0.0.22 out via re0 Oct 30 11:01:16 kabini1 kernel: ipfw: 65500 Deny UDP 126.43.5.41:6881 192.168.0.27:63167 in via re0 Oct 30 11:02:24 kabini1 kernel: ipfw: 65500 Deny P:2 192.168.0.27 224.0.0.22 out via re0 Oct 30 11:02:24 kabini1 kernel: ipfw: 65500 Deny P:2 192.168.0.27 224.0.0.22 out via re0 Oct 31 10:16:03 kabini1 kernel: ipfw: 65500 Deny UDP 216.180.99.2:53 192.168.0.27:28277 in via re0 Nov 2 16:31:12 kabini1 kernel: ipfw: 65500 Deny UDP 192.168.0.4:513 192.168.0.255:513 in via re0 Nov 2 16:32:25 kabini1 kernel: ipfw: 65500 Deny UDP 192.168.0.9:513 192.168.0.255:513 in via re0 Nov 2 16:32:28 kabini1 kernel: ipfw: 65500 Deny UDP 192.168.0.7:513 192.168.0.255:513 in via re0 Nov 2 16:34:12 kabini1 kernel: ipfw: 65500 Deny UDP 192.168.0.4:513 192.168.0.255:513 in via re0 Nov 2 16:35:25 kabini1 kernel: ipfw: 65500 Deny UDP 192.168.0.9:513 192.168.0.255:513 in via re0 Nov 2 16:35:28 kabini1 kernel: ipfw: 65500 Deny UDP 192.168.0.7:513 192.168.0.255:513 in via re0 Nov 2 16:37:12 kabini1 kernel: ipfw: 65500 Deny UDP 192.168.0.4:513 192.168.0.255:513 in via re0 Nov 2 16:38:25 kabini1 kernel: ipfw: 65500 Deny UDP 192.168.0.9:513 192.168.0.255:513 in via re0 Sun Nov 2 16:38:26 CST 2014 [root@kabini1, /etc, 4:38:26pm] 337 % [wam@kabini1, ~, 9:03:43am] 330 % ruptime -a Q6600 up 299+08:00, 6 users, load 0.03, 0.04, 0.05 athloncube up 45+21:08, 4 users, load 0.00, 0.01, 0.05 kabini1 up 23:01, 1 user, load 0.35, 0.19, 0.10 opty165a up 299+08:00, 4 users, load 0.00, 0.00, 0.00 [wam@kabini1, ~, 4:34:49pm] 330 % ruptime Q6600 down 0:13 athloncube down 0:14 kabini1 up 23:07, 0 users, load 0.21, 0.26, 0.16 opty165a down 0:13 [wam@kabini1, ~, 4:41:57pm] 331 % ruptime -a Q6600 down 0:13 athloncube down 0:14 kabini1 up 23:07, 1 user, load 0.21, 0.26, 0.16 opty165a down 0:13 [wam@kabini1, ~, 4:42:03pm] 332 % err, well, I had it for a second :-/ .... -- William A. Mahaffey III ---------------------------------------------------------------------- "The M1 Garand is without doubt the finest implement of war ever devised by man." -- Gen. George S. Patton Jr.