From owner-freebsd-questions@FreeBSD.ORG Tue Jul 13 06:30:13 2004 Return-Path: Delivered-To: freebsd-questions@freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id F12B316A4CE for ; Tue, 13 Jul 2004 06:30:13 +0000 (GMT) Received: from bilbo.otenet.gr (bilbo.otenet.gr [195.170.0.13]) by mx1.FreeBSD.org (Postfix) with ESMTP id F198443D41 for ; Tue, 13 Jul 2004 06:30:11 +0000 (GMT) (envelope-from keramida@ceid.upatras.gr) Received: from orion.daedalusnetworks.priv (aris.bedc.ondsl.gr [62.103.39.226])i6D6U4Ix023291; Tue, 13 Jul 2004 09:30:06 +0300 Received: from orion.daedalusnetworks.priv (orion [127.0.0.1]) i6D6WRE5040174; Tue, 13 Jul 2004 09:32:27 +0300 (EEST) (envelope-from keramida@ceid.upatras.gr) Received: (from keramida@localhost)i6D6WNg6040173; Tue, 13 Jul 2004 09:32:23 +0300 (EEST) (envelope-from keramida@ceid.upatras.gr) Date: Tue, 13 Jul 2004 09:32:23 +0300 From: Giorgos Keramidas To: Luke Message-ID: <20040713063223.GA39956@orion.daedalusnetworks.priv> References: Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: cc: freebsd-questions@freebsd.org Subject: Re: Is this a safe ipfilter rule? X-BeenThere: freebsd-questions@freebsd.org X-Mailman-Version: 2.1.1 Precedence: list List-Id: User questions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 13 Jul 2004 06:30:14 -0000 On 2004-07-12 23:15, Luke wrote: > This is the scariest of these rules: > pass in quick proto udp from ip.of.remote.DNS/32 port = 53 to any Well, paranoia is ok some times. At least, as long as it doesn't stop you from doing your work ;-) However, given a good named setup (ACLs in named.conf that make sure no transfers or queries allowed to anyone, except for those that really need to ask *your* named) you shouldn't have serious problems even with rules like these: pass in quick proto udp from any port = 53 to any pass in quick proto udp from any to any port = 53 pass out quick proto udp from any port = 53 to any pass out quick proto udp from any to any port = 53 > Is this safe? It depends on the setup of your named, I guess. > pass out quick proto udp from my.internal.address.range to any keep state > [...] However, I have a problem with that [...] If stateful UDP:53 is a problem because of the load you have, you might want to consider the following setup: - Allow all packets to/from port 53 of your ISP's named (without keeping state information in the firewall). - Set up your ISP's named as a "forwarder". Giorgos