From owner-freebsd-questions Mon Feb 4 13:46:43 2002 Delivered-To: freebsd-questions@freebsd.org Received: from topaz.mdcc.cx (topaz.mdcc.cx [212.204.230.141]) by hub.freebsd.org (Postfix) with ESMTP id 2A36937B420 for ; Mon, 4 Feb 2002 13:46:37 -0800 (PST) Received: from k7.mavetju.org (topaz.mdcc.cx [212.204.230.141]) by topaz.mdcc.cx (Postfix) with ESMTP id C0A382B78A; Mon, 4 Feb 2002 22:46:26 +0100 (CET) Received: by k7.mavetju.org (Postfix, from userid 1001) id 7D61B56D; Tue, 5 Feb 2002 08:46:09 +1100 (EST) Date: Tue, 5 Feb 2002 08:46:09 +1100 From: Edwin Groothuis To: jacks@sage-american.com Cc: freebsd-questions@freebsd.org Subject: Re: Firewall Denies - w/info Message-ID: <20020205084609.P1599@k7.mavetju.org> Mail-Followup-To: Edwin Groothuis , jacks@sage-american.com, freebsd-questions@freebsd.org References: <3.0.5.32.20020204135700.01917078@mail.sage-american.com> <3.0.5.32.20020204135700.01917078@mail.sage-american.com> <20020205075442.O1599@k7.mavetju.org> <3.0.5.32.20020204153106.01917078@mail.sage-american.com> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline User-Agent: Mutt/1.2.5.1i In-Reply-To: <3.0.5.32.20020204153106.01917078@mail.sage-american.com>; from jacks@sage-american.com on Mon, Feb 04, 2002 at 03:31:06PM -0600 Sender: owner-freebsd-questions@FreeBSD.ORG Precedence: bulk List-ID: List-Archive: (Web Archive) List-Help: (List Instructions) List-Subscribe: List-Unsubscribe: X-Loop: FreeBSD.ORG On Mon, Feb 04, 2002 at 03:31:06PM -0600, jacks@sage-american.com wrote: > hmmmm.... thought I had the dns udps covered with these DNS-specific rules: > (of course, "odnsx" = outside nameserver) > # DNS - Allow queries out in the world > #${fwcmd} add pass udp from any to ${odns1} 53 > #${fwcmd} add pass udp from any to ${odns2} 53 > #${fwcmd} add pass udp from ${odns1} 53 to any > #${fwcmd} add pass udp from ${odns2} 53 to any > #${fwcmd} add pass udp from any to ${odns3} 53 > #${fwcmd} add pass udp from any to ${odns4} 53 > #${fwcmd} add pass udp from ${odns3} 53 to any > #${fwcmd} add pass udp from ${odns4} 53 to any > > Where do you see the missing rule that is blocking the udps..??? I see a lot of #'s, which are comments. Furthermore, you need to give access to *all* DNS servers in the world, unless you are using the forward statement to your ISP. In that case, you also don't need the root.hints statement in your named.conf. Edwin -- Edwin Groothuis | Personal website: http://www.MavEtJu.org edwin@mavetju.org | Interested in MUDs? Visit Fatal Dimensions: ------------------+ http://www.FatalDimensions.org/ To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-questions" in the body of the message