Date: Mon, 04 Feb 2002 15:31:06 -0600 From: jacks@sage-american.com To: Edwin Groothuis <edwin@mavetju.org> Cc: freebsd-questions@freebsd.org Subject: Re: Firewall Denies - w/info Message-ID: <3.0.5.32.20020204153106.01917078@mail.sage-american.com> In-Reply-To: <20020205075442.O1599@k7.mavetju.org> References: <3.0.5.32.20020204135700.01917078@mail.sage-american.com> <3.0.5.32.20020204135700.01917078@mail.sage-american.com>
next in thread | previous in thread | raw e-mail | index | archive | help
hmmmm.... thought I had the dns udps covered with these DNS-specific rules:
(of course, "odnsx" = outside nameserver)
# DNS - Allow queries out in the world
#${fwcmd} add pass udp from any to ${odns1} 53
#${fwcmd} add pass udp from any to ${odns2} 53
#${fwcmd} add pass udp from ${odns1} 53 to any
#${fwcmd} add pass udp from ${odns2} 53 to any
#${fwcmd} add pass udp from any to ${odns3} 53
#${fwcmd} add pass udp from any to ${odns4} 53
#${fwcmd} add pass udp from ${odns3} 53 to any
#${fwcmd} add pass udp from ${odns4} 53 to any
Where do you see the missing rule that is blocking the udps..???
At 07:54 AM 2.5.2002 +1100, Edwin Groothuis wrote:
>On Mon, Feb 04, 2002 at 01:57:00PM -0600, jacks@sage-american.com wrote:
>> Sheesh! Here are the denies with the questions again. Sorry!
>> I'm getrting a lot of these "denies" of outgoing UDP shown in my firewall
>> log. The lookups show they are NSLs or root.servers, but not MY
>> nameservers. Many are on port 1024, but not always (some on the samba
ports).
>>
>> Also, some try to go out on port 53, but not to MY nameservers....
>>
>> Since it looks like the requests are coming from my machines, they look
>> harmless & wonder if I need the requests, and what could be asking for the
>> info. Does anyone know what these are for...??? ...or what is asking for
>> the info?
>>
>> Deny UDP 64.xxx.xx.xxx:1024 198.41.0.4:53 out via tun0
>> Deny UDP 64.xxx.xx.xxx:1024 192.203.230.10:53 out via tun0
>> Deny UDP 64.xxx.xx.xxx:1024 192.36.148.17:53 out via tun0
>> Deny UDP 64.xxx.xx.xxx:1024 198.32.64.12:53 out via tun0
>
>These are *from* your nameserver-process to the root-nameservers.
>That's how the protocol is designed and works. Just open all the
>ports from your nameserver to everywhere port 53, on both tcp and
>udp, and your nameserver will work fine.
>
>Edwin
>
>--
>Edwin Groothuis | Personal website: http://www.MavEtJu.org
>edwin@mavetju.org | Interested in MUDs? Visit Fatal Dimensions:
>------------------+ http://www.FatalDimensions.org/
>
>
Best regards,
Jack L. Stone,
Server Admin
===================================================
Sage-American
http://www.sage-american.com
jacks@sage-american.com
"My center is giving way, my right is in retreat;
....situation excellent! ....I shall attack!"
===================================================
To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-questions" in the body of the message
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?3.0.5.32.20020204153106.01917078>