From owner-freebsd-questions Sun Dec 15 10:52:52 2002 Delivered-To: freebsd-questions@freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id 9C3B437B401 for ; Sun, 15 Dec 2002 10:52:50 -0800 (PST) Received: from sage.thought.org (dsl231-043-140.sea1.dsl.speakeasy.net [216.231.43.140]) by mx1.FreeBSD.org (Postfix) with ESMTP id 9E86B43E4A for ; Sun, 15 Dec 2002 10:52:49 -0800 (PST) (envelope-from kline@thought.org) Received: from thought.org (root@tao [10.0.0.247]) by sage.thought.org (8.11.4/8.11.4) with ESMTP id gBFIqu822889 for ; Sun, 15 Dec 2002 10:52:57 -0800 (PST) (envelope-from kline@thought.org) Received: (from kline@localhost) by thought.org (8.12.6/8.11.3) id gBFIqmUt018533 for freebsd-questions@FreeBSD.ORG; Sun, 15 Dec 2002 10:52:48 -0800 (PST) (envelope-from kline) Date: Sun, 15 Dec 2002 10:52:46 -0800 From: Gary D Kline To: FreeBSD Mailing List Subject: translation to ipfw? Message-ID: <20021215185246.GA18501@tao.thought.org> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline X-Organization: Thought Unlimited. Public service Unix since 1986. X-Of_Interest: Observing 16 years of service to the Unix community User-Agent: Mutt/1.5.1i Sender: owner-freebsd-questions@FreeBSD.ORG Precedence: bulk List-ID: List-Archive: (Web Archive) List-Help: (List Instructions) List-Subscribe: List-Unsubscribe: X-Loop: FreeBSD.ORG Hi Folks, Can anybody translate the following ipf rules to ipfw for me? Given a few examples as a template, I should be able to handle the rest myself. According to some -security postings from 2000, the thought was that ipf was superior.... is this still the case? thanks in advance, gary pass out quick on dc0 proto tcp from any to any keep state pass out quick on dc0 proto udp from any to any keep state pass out quick on dc0 proto icmp from any to any keep state block out quick on dc0 all # use next line if ISP uses DHCP # pass in quick on dc0 proto udp from X.X.X.X/32 to any port = 68 keep state # Let in SSH on port 22 pass in quick on dc0 proto tcp from any to 216.231.43.140/32 port = 22 keep state pass in quick on dc0 proto udp from any to 216.231.43.140/32 port = 22 keep state . . . # Let in FTP data connections pass in quick on dc0 proto tcp from any to any port 7499 >< 8501 pass in quick on dc0 proto tcp from any to any port = 21 # Let pings return pass in quick on dc0 proto icmp from any to 216.231.43.140/32 icmp-type echo -- Gary Kline kline@thought.org www.thought.org Public service Unix To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-questions" in the body of the message