From owner-freebsd-questions@FreeBSD.ORG  Fri Feb  6 09:56:34 2004
Return-Path: <owner-freebsd-questions@FreeBSD.ORG>
Delivered-To: freebsd-questions@freebsd.org
Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125])
	by hub.freebsd.org (Postfix) with ESMTP id 0AA7116A4CE
	for <freebsd-questions@freebsd.org>;
	Fri,  6 Feb 2004 09:56:33 -0800 (PST)
Received: from GWMAIL.co.travis.tx.us (gwmail.co.travis.tx.us
	[198.214.208.12])
	by mx1.FreeBSD.org (Postfix) with ESMTP id 743CE43D5E
	for <freebsd-questions@freebsd.org>;
	Fri,  6 Feb 2004 09:56:32 -0800 (PST)
	(envelope-from Chris.Nowlin@co.travis.tx.us)
Received: from DO_GWMAIL-MTA by GWMAIL.co.travis.tx.us
	with Novell_GroupWise; Fri, 06 Feb 2004 10:58:40 -0600
Message-Id: <s0237360.026@GWMAIL.co.travis.tx.us>
X-Mailer: Novell GroupWise Internet Agent 6.5.1 
Date: Fri, 06 Feb 2004 10:58:22 -0600
From: "Chris Nowlin" <Chris.Nowlin@co.travis.tx.us>
To: <freebsd-questions@freebsd.org>
Mime-Version: 1.0
Content-Type: text/plain; charset=US-ASCII
Content-Transfer-Encoding: 7bit
Content-Disposition: inline
Subject: firewall rule(s) for ports and packages
X-BeenThere: freebsd-questions@freebsd.org
X-Mailman-Version: 2.1.1
Precedence: list
List-Id: User questions <freebsd-questions.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-questions>,
	<mailto:freebsd-questions-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-questions>
List-Post: <mailto:freebsd-questions@freebsd.org>
List-Help: <mailto:freebsd-questions-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-questions>,
	<mailto:freebsd-questions-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Fri, 06 Feb 2004 17:56:34 -0000

I'm trying out 5.1 and 5.2, and with each, I utilize IPFW2 for the
firewall. My rules allow passive FTP from the server, but often this
does not seem to cover me when adding ports. To temporarily solve this
(each time with the intention to find the correct solution) I just add a
rule at the top to allow tcp from any to any via any. When the port
install is done, I delete that rule.

This is certainly the way I've had to do it when adding ports inside a
jail - even things that worked from the main server, don't get past the
firewall from inside the jail. I use "to me" and "from me" to identify
the server, which only has one network interface. It's listening on two
IPs (after creating the jail, I had to ifconfig an alias for the
interface) but I thought that "me" would imply any IP address the
interface was listening to.

Surely there is a better way. For the "me" part I can always have two
rules, one allowing the appropriate traffic for each IP address (instead
of just using "me") but what about a solution for the quick-fix when
adding ports?

Thanks,
Chris