Date: Tue, 5 Feb 2002 08:46:09 +1100 From: Edwin Groothuis <edwin@mavetju.org> To: jacks@sage-american.com Cc: freebsd-questions@freebsd.org Subject: Re: Firewall Denies - w/info Message-ID: <20020205084609.P1599@k7.mavetju.org> In-Reply-To: <3.0.5.32.20020204153106.01917078@mail.sage-american.com>; from jacks@sage-american.com on Mon, Feb 04, 2002 at 03:31:06PM -0600 References: <3.0.5.32.20020204135700.01917078@mail.sage-american.com> <3.0.5.32.20020204135700.01917078@mail.sage-american.com> <20020205075442.O1599@k7.mavetju.org> <3.0.5.32.20020204153106.01917078@mail.sage-american.com>
next in thread | previous in thread | raw e-mail | index | archive | help
On Mon, Feb 04, 2002 at 03:31:06PM -0600, jacks@sage-american.com wrote:
> hmmmm.... thought I had the dns udps covered with these DNS-specific rules:
> (of course, "odnsx" = outside nameserver)
> # DNS - Allow queries out in the world
> #${fwcmd} add pass udp from any to ${odns1} 53
> #${fwcmd} add pass udp from any to ${odns2} 53
> #${fwcmd} add pass udp from ${odns1} 53 to any
> #${fwcmd} add pass udp from ${odns2} 53 to any
> #${fwcmd} add pass udp from any to ${odns3} 53
> #${fwcmd} add pass udp from any to ${odns4} 53
> #${fwcmd} add pass udp from ${odns3} 53 to any
> #${fwcmd} add pass udp from ${odns4} 53 to any
>
> Where do you see the missing rule that is blocking the udps..???
I see a lot of #'s, which are comments.
Furthermore, you need to give access to *all* DNS servers in the
world, unless you are using the forward statement to your ISP. In
that case, you also don't need the root.hints statement in your
named.conf.
Edwin
--
Edwin Groothuis | Personal website: http://www.MavEtJu.org
edwin@mavetju.org | Interested in MUDs? Visit Fatal Dimensions:
------------------+ http://www.FatalDimensions.org/
To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-questions" in the body of the message
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20020205084609.P1599>