From owner-freebsd-questions@FreeBSD.ORG Mon Apr 17 22:44:15 2006 Return-Path: X-Original-To: freebsd-questions@freebsd.org Delivered-To: freebsd-questions@freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id D4D4016A402 for ; Mon, 17 Apr 2006 22:44:15 +0000 (UTC) (envelope-from david@catwhisker.org) Received: from bunrab.catwhisker.org (adsl-63-193-123-122.dsl.snfc21.pacbell.net [63.193.123.122]) by mx1.FreeBSD.org (Postfix) with ESMTP id 8191843D46 for ; Mon, 17 Apr 2006 22:44:15 +0000 (GMT) (envelope-from david@catwhisker.org) Received: from bunrab.catwhisker.org (localhost [127.0.0.1]) by bunrab.catwhisker.org (8.13.3/8.13.3) with ESMTP id k3HMiF9w037833 for ; Mon, 17 Apr 2006 15:44:15 -0700 (PDT) (envelope-from david@bunrab.catwhisker.org) Received: (from david@localhost) by bunrab.catwhisker.org (8.13.3/8.13.1/Submit) id k3HMiFlI037832 for freebsd-questions@freebsd.org; Mon, 17 Apr 2006 15:44:15 -0700 (PDT) (envelope-from david) Date: Mon, 17 Apr 2006 15:44:15 -0700 From: David Wolfskill To: freeBSD List Message-ID: <20060417224415.GY32062@bunrab.catwhisker.org> References: <71010EE4-5C3E-48D9-8634-3605CE86F8C5@allresearch.com> <3BE1F863-F59D-49EC-A9D4-AEF6D89C5ABD@mac.com> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <3BE1F863-F59D-49EC-A9D4-AEF6D89C5ABD@mac.com> User-Agent: Mutt/1.4.2.1i Subject: Re: IPFW Problems? X-BeenThere: freebsd-questions@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: User questions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 17 Apr 2006 22:44:15 -0000 On Mon, Apr 17, 2006 at 06:29:13PM -0400, Charles Swiger wrote: > ... > [ ...redirected to freebsd-questions... ] Thanks for doing that! > ... > You don't have a check-state rule anywhere, so you either need to add > one or a rule to pass established traffic to and from port 22. I thought check-state was fairly optional; ref: These dynamic rules, which have a limited lifetime, are checked at the first occurrence of a check-state, keep-state or limit rule, and are typ- ically used to open the firewall on-demand to legitimate traffic only. See the STATEFUL FIREWALL and EXAMPLES Sections below for more informa- tion on the stateful behaviour of ipfw. (from "man ipfw" on a 4.11 system). Peace, david -- David H. Wolfskill david@catwhisker.org Mail filters, like sewers, need to be most restrictive at the point of entry. See http://www.catwhisker.org/~david/publickey.gpg for my public key.