From owner-freebsd-questions  Mon Oct  8 15:48: 4 2001
Delivered-To: freebsd-questions@freebsd.org
Received: from chmls20.mediaone.net (chmls20.mediaone.net [24.147.1.156])
	by hub.freebsd.org (Postfix) with ESMTP id BF72F37B401
	for <freebsd-questions@FreeBSD.org>; Mon,  8 Oct 2001 15:48:00 -0700 (PDT)
Received: from acadia.ne.mediaone.net (acadia.ne.mediaone.net [65.96.185.189])
	by chmls20.mediaone.net (8.11.1/8.11.1) with ESMTP id f98Mmbx02369
	for <freebsd-questions@FreeBSD.org>; Mon, 8 Oct 2001 18:48:38 -0400 (EDT)
Received: (from leblanc@localhost)
	by acadia.ne.mediaone.net (8.11.6/8.11.5) id f98Mlsj02134
	for freebsd-questions@FreeBSD.org; Mon, 8 Oct 2001 18:47:54 -0400 (EDT)
	(envelope-from leblanc)
Date: Mon, 8 Oct 2001 18:47:53 -0400
From: Louis LeBlanc <leblanc+freebsd@smtp.ne.mediaone.net>
To: freebsd-questions@FreeBSD.org
Subject: firewall kills my dns access ???
Message-ID: <20011008184753.B589@acadia.ne.mediaone.net>
Reply-To: freebsd-questions@FreeBSD.org
Mail-Followup-To: freebsd-questions@FreeBSD.org
Mime-Version: 1.0
Content-Type: text/plain; charset=iso-8859-1
Content-Disposition: inline
Content-Transfer-Encoding: 8bit
User-Agent: Mutt/1.3.22.1i
X-bright-idea: Lets abolish HTML mail!
Sender: owner-freebsd-questions@FreeBSD.ORG
Precedence: bulk
List-ID: <freebsd-questions.FreeBSD.ORG>
List-Archive: <http://docs.freebsd.org/mail/> (Web Archive)
List-Help: <mailto:majordomo@FreeBSD.ORG?subject=help> (List Instructions)
List-Subscribe: <mailto:majordomo@FreeBSD.ORG?subject=subscribe%20freebsd-questions>
List-Unsubscribe: <mailto:majordomo@FreeBSD.ORG?subject=unsubscribe%20freebsd-questions>
X-Loop: FreeBSD.ORG

Hey again.  Another firewall question.

I have a problem with the firewall setup and DNS servers.  I have the
following, adapted from an online tool:


# forward-only can use regular TCP protocol to forwarders
ipfw add allow udp from $IPADDR 53 to $NAMESERVER_1 53 via
$EXT_INTERFACE out
ipfw add allow udp from $NAMESERVER_1 53 to $IPADDR 53 via
$EXT_INTERFACE in
ipfw add allow tcp from $IPADDR $UNPRIVPORTS to $NAMESERVER_1 53 \
           via $EXT_INTERFACE out
ipfw add allow tcp from $NAMESERVER_1 53 to $IPADDR $UNPRIVPORTS \
           via $EXT_INTERFACE in  established


Seems like a lot of work to me, but can anyone see a problem with
this?  I typically get 3 nameserver IPs from the dhcp server, and I
have a set of these commands for each (ie. NAMESERVER_1, NAMESERVER_2,
etc.).  The problem is that it appears the connection is broken or
disallowed somehow.

Any ideas how this *should* look?

TIA and HAND
Lou
-- 
Louis LeBlanc       leblanc@acadia.ne.mediaone.net
Fully Funded Hobbyist, KeySlapper Extrordinaire :)
http://acadia.ne.mediaone.net                 ԿԬ

QOTD:
  "Who?  Me?  No, no, NO!!  But I do sell rugs."


To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-questions" in the body of the message