Date: Mon, 17 Apr 2006 15:44:15 -0700 From: David Wolfskill <david@catwhisker.org> To: freeBSD List <freebsd-questions@freebsd.org> Subject: Re: IPFW Problems? Message-ID: <20060417224415.GY32062@bunrab.catwhisker.org> In-Reply-To: <3BE1F863-F59D-49EC-A9D4-AEF6D89C5ABD@mac.com> References: <71010EE4-5C3E-48D9-8634-3605CE86F8C5@allresearch.com> <3BE1F863-F59D-49EC-A9D4-AEF6D89C5ABD@mac.com>
next in thread | previous in thread | raw e-mail | index | archive | help
On Mon, Apr 17, 2006 at 06:29:13PM -0400, Charles Swiger wrote:
> ...
> [ ...redirected to freebsd-questions... ]
Thanks for doing that!
> ...
> You don't have a check-state rule anywhere, so you either need to add
> one or a rule to pass established traffic to and from port 22.
I thought check-state was fairly optional; ref:
These dynamic rules, which have a limited lifetime, are checked at the
first occurrence of a check-state, keep-state or limit rule, and are typ-
ically used to open the firewall on-demand to legitimate traffic only.
See the STATEFUL FIREWALL and EXAMPLES Sections below for more informa-
tion on the stateful behaviour of ipfw.
(from "man ipfw" on a 4.11 system).
Peace,
david
--
David H. Wolfskill david@catwhisker.org
Mail filters, like sewers, need to be most restrictive at the point of entry.
See http://www.catwhisker.org/~david/publickey.gpg for my public key.
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20060417224415.GY32062>