From nobody Mon Dec 9 12:43:14 2024 X-Original-To: freebsd-current@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4Y6M3f3LLhz5gGHv for ; Mon, 09 Dec 2024 12:43:26 +0000 (UTC) (envelope-from junchoon@dec.sakura.ne.jp) Received: from www121.sakura.ne.jp (www121.sakura.ne.jp [153.125.133.21]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (Client did not present a certificate) by mx1.freebsd.org (Postfix) with ESMTPS id 4Y6M3d1Tvzz44gl; Mon, 9 Dec 2024 12:43:24 +0000 (UTC) (envelope-from junchoon@dec.sakura.ne.jp) Authentication-Results: mx1.freebsd.org; none Received: from kalamity.joker.local (124-18-43-234.area1a.commufa.jp [124.18.43.234]) (authenticated bits=0) by www121.sakura.ne.jp (8.17.1/8.17.1/[SAKURA-WEB]/20201212) with ESMTPA id 4B9ChE9A042288; Mon, 9 Dec 2024 21:43:15 +0900 (JST) (envelope-from junchoon@dec.sakura.ne.jp) DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; d=dec.sakura.ne.jp; s=s2405; t=1733748196; bh=DrtVfL/6sVwphHX9yii5L6eEnTTBJQlEBUXAUWzGI+w=; h=Date:From:To:Cc:Subject:In-Reply-To:References; b=E+QtPpZKPquRiDPqnYkf3my9/9As0GXMHeV+HDJ5vivZWtjGHTmAklnMzlPKTkdU2 iH3vrgFdi2ilgaE5iqLeACIGqOJ8vR2eCrj6L6PPX/Nla1welqEFI36CjniJqwNHfo jVtfu6vcisKlseUNshKCrNQwwPpCIWFPewpRmk+w= Date: Mon, 9 Dec 2024 21:43:14 +0900 From: Tomoaki AOKI To: Juraj Lutter Cc: Ronald Klop , FreeBSD User , freebsd-current@freebsd.org Subject: Re: (ipfw) Re: HELP! fetch: stuck forever OR error: RPC failed: curl 56 recv failure: Operation timed out Message-Id: <20241209214314.2443b590d774423a2b97f0a8@dec.sakura.ne.jp> In-Reply-To: <8E43EAA1-BA3E-4655-ACE1-2E4523E901DE@FreeBSD.org> References: <20241206034709.4dd32cc5@thor.intern.walstatt.dynvpn.de> <279848701.11738.1733510402875@localhost> <20241206210947.3ae835e4@thor.intern.walstatt.dynvpn.de> <8E43EAA1-BA3E-4655-ACE1-2E4523E901DE@FreeBSD.org> Organization: Junchoon corps X-Mailer: Sylpheed 3.7.0 (GTK+ 2.24.33; amd64-portbld-freebsd14.1) List-Id: Discussions about the use of FreeBSD-current List-Archive: https://lists.freebsd.org/archives/freebsd-current List-Help: List-Post: List-Subscribe: List-Unsubscribe: Sender: owner-freebsd-current@FreeBSD.org Mime-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit X-Rspamd-Pre-Result: action=no action; module=replies; Message is reply to one we originated X-Spamd-Result: default: False [-4.00 / 15.00]; REPLY(-4.00)[]; ASN(0.00)[asn:7684, ipnet:153.125.128.0/18, country:JP] X-Rspamd-Queue-Id: 4Y6M3d1Tvzz44gl X-Spamd-Bar: ---- On Mon, 9 Dec 2024 11:09:14 +0100 Juraj Lutter wrote: > > On 8 Dec 2024, at 20:30, Ronald Klop wrote: > > > > Hi, > > > > I can reproduce your error. > > > > A cronjob which does a scp to another server didn't work anymore. When I go back to the previous BE it works fine again. > > Ipfw disable firewall also makes the scp work. > > > > Scp also seems to work fine if I replace the statefull firewall rules with stateless "pass all from any to any". > > Have you tried to allow ICMP in both directions explicitly, in case of stateful rules? > > — > Juraj Lutter > otis@FreeBSD.org I think would usually work for clients with some limited services exposed to outside. IIUC, it basically allow all sessions from inside and allows limited serivices configured with variables via /etc/rc.conf[.local]. Some notes. *Last actual changes in /usr/src/libexec/rc/rc.firewall was at Jul.23, 2020. https://github.com/freebsd/freebsd-src/commits/main/libexec/rc/rc.firewall [cgit.freebsd.org seems to be unstable now.] *Variable firewall_logif currently does not exist. *Don't you need allowing 22/UDP, too, like below? firewall_myservices="22/tcp 22/udp" And if you're creating kernel config from scratch (such as copying from GENERIC at some point and editing it), it's no longer adviced. It's not robust for changes in GENERIC. Instead, include GENERIC and describe changes you want. An example (one of my test kernel config for a bit old stable). ===== Start example ===== include GENERIC ident TEST15 nooptions DDB nooptions GDB nooptions INVARIANTS nooptions INVARIANT_SUPPORT nooptions WITNESS nooptions WITNESS_SKIPSPIN nooptions DEADLKRES options CAM_IOSCHED_DYNAMIC device sg ===== End example ===== -- Tomoaki AOKI