Skip site navigation (1)Skip section navigation (2)
Date:      Sun, 13 Jan 2002 16:38:15 -0500
From:      Steve Brown <freebsd@prayforwind.com>
To:        Dru <genisis@istar.ca>, freebsd-questions <freebsd-questions@freebsd.org>
Subject:   Re: Dru's Onlamp article on IPFW rulesets
Message-ID:  <3C41FE47.8010407@prayforwind.com>
References:  <20020113152814.D92561-100000@x1-6-00-50-ba-de-36-33.kico1.on.home.com>

next in thread | previous in thread | raw e-mail | index | archive | help
Hey thanks Dru, looks like I lucked out

Here's what I get. I suspect the 1'st 3 lines causing trouble, they're 
in rc.firewall. But what do I do about it?

00100  0    0 allow ip from any to any via lo0
00200  0    0 deny ip from any to 127.0.0.0/8
00300  0    0 deny ip from 127.0.0.0/8 to any
00300  0    0 check-state
00301  0    0 deny tcp from any to any in established
00302  0    0 allow tcp from any to any keep-state out setup
00400  0    0 allow udp from 209.226.175.223 53 to any in recv vr0
00401  0    0 allow udp from 198.235.216.134 53 to any in recv vr0
00402  0    0 allow udp from 207.236.176.9 53 to any in recv vr0
00403  0    0 allow udp from 198.235.216.111 53 to any in recv vr0
00404  0    0 allow udp from 207.236.176.10 53 to any in recv vr0
00405  0    0 allow udp from 198.235.216.112 53 to any in recv vr0
00406  0    0 allow udp from 209.197.128.2 53 to any in recv vr0
00407  0    0 allow udp from 209.197.128.5 53 to any in recv vr0
00409 20 1260 allow udp from any to any out
65535 21 4059 deny ip from any to any

Thanks, Steve

Dru wrote:

> 
> On Sun, 13 Jan 2002, Steve Brown wrote:
> 
> 
>>Hi Dru, or anyone who can help me out please?
>>
>>I'm still completely blocked from the internet after applying the
>>ruleset in the following article:
>>http://www.onlamp.com/pub/a/bsd/2001/05/09/FreeBSD_Basics.html
>>I got through the previous article
>>http://www.onlamp.com/pub/a/bsd/2001/04/25/FreeBSD_Basics.html
>>just fine.
>>
>>In order to get back on internet at all I keep having to comment out my
>>kernel & rc.conf firewall options and re-compiling my kernel; it's
>>getting frustrating. Can anyone tell me what I'm doing wrong?
>>
>>Here's my kernel options, rc.conf options, ipfw.rules. I'm using
>>FreeBSD4.4-RELEASE and I've not modified /etc/rc.firewall. I'm using
>>DHCP from a BB router which is connected to DSL
>>
>>################# Kernel options#######################
>>options               IPFIREWALL
>>options               IPFIREWALL_VERBOSE
>>options               IPFIREWALL_VERBOSE_LIMIT=10
>>options               IPSTEALTH # Hide from traceroute
>># To hide from nmap, don't use if running web server (I am doing so)
>># options             TCP_DROP_SYNFIN
>># # To hide from portscans. causes "config MYKERNEL"
>># # to display "unknown option" error on my system
>># # options             TCP_RESTRICT_RST
>>
>>################# rc.conf additions ###################
>>
>>firewall_enable="YES"
>>firewall_script="/etc/rc.firewall"
>>firewall_type="/etc/ipfw.rules"
>>firewall_quiet="NO"     #change to YES once happy with rules
>>firewall_logging_enable="YES"log_in_vain="YES"
>>tcp_drop_synfin="NO"   #change to YES if no webserver
>># tcp_restrict_rst="YES"
>>icmp_drop_redirect="YES"
>>
>>#################### ipfw.rules ######################
>># allow tcp/ip outgoing, and appropriate answerback's
>>add 00300 check-state
>>add 00301 deny tcp from any to any in established
>>add 00302 allow tcp from any to any out setup keep-state
>>
>># allow DNS
>>add 0400 allow udp from 209.226.175.223 53 to any in recv vr0
>>add 0401 allow udp from 198.235.216.134 53 to any in recv vr0
>>add 0402 allow udp from 207.236.176.9 53 to any in recv vr0
>>add 0403 allow udp from 198.235.216.111 53 to any in recv vr0
>>add 0404 allow udp from 207.236.176.10 53 to any in recv vr0
>>add 0405 allow udp from 198.235.216.112 53 to any in recv vr0
>>add 0406 allow udp from 209.197.128.2 53 to any in recv vr0
>>add 0407 allow udp from 209.197.128.5 53 to any in recv vr0
>>
>>add 00409 allow udp from any to any out
>>
> 
> Hi Steve,
> 
> What's the output of "ipfw show"?
> 
> Dru
> 
> 




To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-questions" in the body of the message




Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?3C41FE47.8010407>