Date: Mon, 04 Feb 2002 15:58:05 -0600 From: jacks@sage-american.com To: Edwin Groothuis <edwin@mavetju.org> Cc: freebsd-questions@FreeBSD.ORG Subject: Re: Firewall Denies - w/info Message-ID: <3.0.5.32.20020204155805.01917078@mail.sage-american.com> In-Reply-To: <20020205075442.O1599@k7.mavetju.org> References: <3.0.5.32.20020204135700.01917078@mail.sage-american.com> <3.0.5.32.20020204135700.01917078@mail.sage-american.com>
next in thread | previous in thread | raw e-mail | index | archive | help
I changed the rules to the following for the DNS and seems to have fixed
the DNS blocks. But, are "dynamic" rules now....
# ${fwcmd} add pass tcp from any to ${oip} 53 setup
# ${fwcmd} add pass udp from any to ${oip} 53
# ${fwcmd} add pass udp from ${oip} 53 to any
# ${fwcmd} add pass udp from ${oip} to any 53 keep-state
At 07:54 AM 2.5.2002 +1100, Edwin Groothuis wrote:
>On Mon, Feb 04, 2002 at 01:57:00PM -0600, jacks@sage-american.com wrote:
>> Sheesh! Here are the denies with the questions again. Sorry!
>> I'm getrting a lot of these "denies" of outgoing UDP shown in my firewall
>> log. The lookups show they are NSLs or root.servers, but not MY
>> nameservers. Many are on port 1024, but not always (some on the samba
ports).
>>
>> Also, some try to go out on port 53, but not to MY nameservers....
>>
>> Since it looks like the requests are coming from my machines, they look
>> harmless & wonder if I need the requests, and what could be asking for the
>> info. Does anyone know what these are for...??? ...or what is asking for
>> the info?
>>
>> Deny UDP 64.xxx.xx.xxx:1024 198.41.0.4:53 out via tun0
>> Deny UDP 64.xxx.xx.xxx:1024 192.203.230.10:53 out via tun0
>> Deny UDP 64.xxx.xx.xxx:1024 192.36.148.17:53 out via tun0
>> Deny UDP 64.xxx.xx.xxx:1024 198.32.64.12:53 out via tun0
>
>These are *from* your nameserver-process to the root-nameservers.
>That's how the protocol is designed and works. Just open all the
>ports from your nameserver to everywhere port 53, on both tcp and
>udp, and your nameserver will work fine.
>
>Edwin
>
>--
>Edwin Groothuis | Personal website: http://www.MavEtJu.org
>edwin@mavetju.org | Interested in MUDs? Visit Fatal Dimensions:
>------------------+ http://www.FatalDimensions.org/
>
>To Unsubscribe: send mail to majordomo@FreeBSD.org
>with "unsubscribe freebsd-questions" in the body of the message
>
>
Best regards,
Jack L. Stone,
Server Admin
===================================================
Sage-American
http://www.sage-american.com
jacks@sage-american.com
"My center is giving way, my right is in retreat;
....situation excellent! ....I shall attack!"
===================================================
To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-questions" in the body of the message
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?3.0.5.32.20020204155805.01917078>