From owner-freebsd-questions@FreeBSD.ORG Tue May 10 10:10:00 2005 Return-Path: Delivered-To: freebsd-questions@freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id AB41116A4CE for ; Tue, 10 May 2005 10:10:00 +0000 (GMT) Received: from webmail-outgoing.us4.outblaze.com (webmail-outgoing.us4.outblaze.com [205.158.62.67]) by mx1.FreeBSD.org (Postfix) with ESMTP id 7027743D7D for ; Tue, 10 May 2005 10:10:00 +0000 (GMT) (envelope-from fteg@london.com) Received: from unknown (unknown [192.168.9.180])5FF18180020B for ; Tue, 10 May 2005 10:10:00 +0000 (GMT) X-OB-Received: from unknown (205.158.62.49) by wfilter.us4.outblaze.com; 10 May 2005 10:10:00 -0000 Received: by ws1-1.us4.outblaze.com (Postfix, from userid 1001) id 494C64BEAD; Tue, 10 May 2005 10:10:00 +0000 (GMT) Content-Disposition: inline Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="iso-8859-1" MIME-Version: 1.0 X-Mailer: MIME::Lite 2.117 (F2.6; A1.17; B2.12; Q2.03) Received: from [213.187.181.70] by ws1-1.us4.outblaze.com with http for fteg@london.com; Tue, 10 May 2005 05:09:59 -0500 X-Mailer: mail.com webmail From: "Fafa Hafiz Krantz" To: "Jan Grant" Date: Tue, 10 May 2005 05:09:59 -0500 X-Originating-Ip: 213.187.181.70 X-Originating-Server: ws1-1.us4.outblaze.com Message-Id: <20050510101000.494C64BEAD@ws1-1.us4.outblaze.com> cc: questions@freebsd.org Subject: Re: PF RULES! But mine doesn't ... X-BeenThere: freebsd-questions@freebsd.org X-Mailman-Version: 2.1.1 Precedence: list List-Id: User questions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 10 May 2005 10:10:00 -0000 > It's a question of letting DNS traffic _in_ to your nameserver: > > pass in on $ext_if inet proto { tcp, udp } \ > from any to ($ext_if) port 53 >=20 > ^^^ that lets the traffic in.... >=20 > pass out on $ext_if inet proto { tcp, udp } \ > from ($ext_if) port 53 to any >=20 > ^^^ and that lets it back out. >=20 > If you add the "query-source address * port 53;" to your named.conf > "options" section, that'll suffice; additionally, since your DNS query > source port is then predictable, you can drop it from the DNS and NTP > rule. Hello again, Jan! Well, I tried applying what you said now as well as last time you said it -- but the problem is still there. Unless I uncomment the default deny policy nothing seems to work. The problem must lie elsewhere in my ruleset: int_if=3D"ep0" ext_if=3D"lnc0" # *** Options # set block-policy drop # *** Scrub incoming packets # scrub in all # *** NAT # nat on $ext_if from $int_if:network to any -> ($ext_if) rdr on $int_if proto tcp from any to any \ port 21 -> 127.0.0.1 port 8021 # *** Default deny policy # # block drop log all # *** Pass loopback traffic # pass quick on { lo0 $int_if } # *** Outgoing # pass out on $ext_if inet proto { tcp, udp, icmp } \ from ($ext_if) to any keep state # *** DNS # pass in on $ext_if inet proto { tcp, udp } \ from any to ($ext_if) port 53 pass out on $ext_if inet proto { tcp, udp } \ from ($ext_if) port 53 to any # *** NTP # pass out on $ext_if inet proto udp \ from ($ext_if) to any port { 53, 123 } keep state # *** SSH, HTTP and Ident # pass in on $ext_if inet proto tcp \ from any to ($ext_if) port { 22, 80, 113 } flags S/SA keep state # *** Active FTP # pass in on $ext_if inet proto tcp \ from port 20 to ($ext_if) user proxy flags S/SA keep state # *** Private FTP # pass in on $ext_if proto tcp \ from any to any port 31337 keep state pass in on $ext_if proto tcp \ from any to any port 53333:55555 -- Fafa Hafiz Krantz Research Designer @ http://www.home.no/barbershop Enlightened @ http://www.home.no/barbershop/smart/sharon.pdf --=20 ___________________________________________________________ Sign-up for Ads Free at Mail.com http://promo.mail.com/adsfreejump.htm