From owner-freebsd-questions@FreeBSD.ORG  Mon Oct 31 15:44:06 2005
Return-Path: <owner-freebsd-questions@FreeBSD.ORG>
X-Original-To: freebsd-questions@freebsd.org
Delivered-To: freebsd-questions@freebsd.org
Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125])
	by hub.freebsd.org (Postfix) with ESMTP id AC15F16A41F;
	Mon, 31 Oct 2005 15:44:06 +0000 (GMT)
	(envelope-from keramida@ceid.upatras.gr)
Received: from rosebud.otenet.gr (rosebud.otenet.gr [195.170.0.94])
	by mx1.FreeBSD.org (Postfix) with ESMTP id 438BC43D60;
	Mon, 31 Oct 2005 15:44:04 +0000 (GMT)
	(envelope-from keramida@ceid.upatras.gr)
Received: from flame.pc (aris.bedc.ondsl.gr [62.103.39.226])
	by rosebud.otenet.gr (8.13.4/8.13.4/Debian-1) with SMTP id
	j9VFi2c8010857; Mon, 31 Oct 2005 17:44:02 +0200
Received: from flame.pc (flame [127.0.0.1])
	by flame.pc (8.13.4/8.13.4) with ESMTP id j9VFhwPF010553;
	Mon, 31 Oct 2005 17:43:58 +0200 (EET)
	(envelope-from keramida@ceid.upatras.gr)
Received: (from keramida@localhost)
	by flame.pc (8.13.4/8.13.4/Submit) id j9VFhtKr010550;
	Mon, 31 Oct 2005 17:43:55 +0200 (EET)
	(envelope-from keramida@ceid.upatras.gr)
Date: Mon, 31 Oct 2005 17:43:55 +0200
From: Giorgos Keramidas <keramida@ceid.upatras.gr>
To: Eric F Crist <ecrist@secure-computing.net>
Message-ID: <20051031154355.GA10357@flame.pc>
References: <Pine.LNX.4.56.0510301731420.20733@Mira.dandy.net>
	<F4A7C5AB-A8D1-4E46-A7E0-F1FD95E64ABC@secure-computing.net>
	<20051031144541.GB2122@flame.pc>
Mime-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <20051031144541.GB2122@flame.pc>
Cc: andy@neu.net, freebsd-questions@freebsd.org, freebsd-mobile@freebsd.org
Subject: Re: laptop firewall rules
X-BeenThere: freebsd-questions@freebsd.org
X-Mailman-Version: 2.1.5
Precedence: list
List-Id: User questions <freebsd-questions.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-questions>, 
	<mailto:freebsd-questions-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-questions>
List-Post: <mailto:freebsd-questions@freebsd.org>
List-Help: <mailto:freebsd-questions-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-questions>, 
	<mailto:freebsd-questions-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Mon, 31 Oct 2005 15:44:06 -0000

On 2005-10-31 16:45, Giorgos Keramidas <keramida@ceid.upatras.gr> wrote:
>On 2005-10-30 18:23, Eric F Crist <ecrist@secure-computing.net> wrote:
>>On Oct 30, 2005, at 4:41 PM, andy@neu.net wrote:
>>> Does anyone have a good example of a firewall ruleset for a
>>> wireless interface in a laptop, or a pointer to documentation?
>>> I want to use IPFilter on 6.0 rc1.  I want to let all
>>> connections out and keep state, but block all incoming from
>>> the outside.
>>
>> That ruleset is easy:
>>
>> ipfw add check-state
>> ipfw add allow tcp from me to any setup keep-state
>> ipfw add allow tcp from any to any established
>> ipfw add deny from any to me in
>
> No, please!
>
> If you are using "keep-state", when "allow all established" is
> hardly ever a good idea.

"when" = "then", of course.