From owner-freebsd-doc@FreeBSD.ORG  Wed Feb  2 20:06:19 2005
Return-Path: <owner-freebsd-doc@FreeBSD.ORG>
Delivered-To: freebsd-doc@freebsd.org
Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125])
	by hub.freebsd.org (Postfix) with ESMTP id 3891F16A4CE
	for <freebsd-doc@freebsd.org>; Wed,  2 Feb 2005 20:06:19 +0000 (GMT)
Received: from pi.codefab.com (pi.codefab.com [199.103.21.227])
	by mx1.FreeBSD.org (Postfix) with ESMTP id F10D043D4C
	for <freebsd-doc@freebsd.org>; Wed,  2 Feb 2005 20:06:18 +0000 (GMT)
	(envelope-from cswiger@mac.com)
Received: from localhost (localhost [127.0.0.1])
	by pi.codefab.com (Postfix) with ESMTP id 740A35EEF;
	Wed,  2 Feb 2005 15:06:18 -0500 (EST)
Received: from pi.codefab.com ([127.0.0.1])
 by localhost (pi.codefab.com [127.0.0.1]) (amavisd-new, port 10024)
 with ESMTP id 84458-08; Wed,  2 Feb 2005 15:06:17 -0500 (EST)
Received: from [192.168.1.3] (pool-68-161-50-112.ny325.east.verizon.net
	[68.161.50.112])	by pi.codefab.com (Postfix) with ESMTP id 298165EF2;
	Wed,  2 Feb 2005 15:06:16 -0500 (EST)
Message-ID: <4201329E.6020008@mac.com>
Date: Wed, 02 Feb 2005 15:05:50 -0500
From: Chuck Swiger <cswiger@mac.com>
Organization: The Courts of Chaos
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US;
	rv:1.7.5) Gecko/20041217
X-Accept-Language: en-us, en
MIME-Version: 1.0
To: Graham Dresch <gdresch@spcint.com>
References: <Pine.BSF.4.58.0502021403320.66014@dragon.spcplus.com>
In-Reply-To: <Pine.BSF.4.58.0502021403320.66014@dragon.spcplus.com>
X-Enigmail-Version: 0.90.0.0
X-Enigmail-Supports: pgp-inline, pgp-mime
Content-Type: text/plain; charset=us-ascii; format=flowed
Content-Transfer-Encoding: 7bit
X-Virus-Scanned: amavisd-new at codefab.com
cc: freebsd-doc@freebsd.org
Subject: Re: Error in Handbook
X-BeenThere: freebsd-doc@freebsd.org
X-Mailman-Version: 2.1.1
Precedence: list
List-Id: Documentation project <freebsd-doc.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-doc>,
	<mailto:freebsd-doc-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-doc>
List-Post: <mailto:freebsd-doc@freebsd.org>
List-Help: <mailto:freebsd-doc-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-doc>,
	<mailto:freebsd-doc-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Wed, 02 Feb 2005 20:06:19 -0000

Graham Dresch wrote:

> In Chapter 24 Firewalls:
> 
> Section 24.6.5.7:
> 
> Example ruleset #2:
> 
> $cmd 020 $skip tcp from any to x.x.x.x 53 out via $pif setup keep-state
>                ^^^                                     ^^^^^
> 
> DNS uses UDP, setup is inapplicable to UDP

DNS responses which do not fit into a UDP packet are sent via TCP instead, as 
are zone transfers between nameservers.  DNS uses both 53/tcp and 53/udp.

-- 
-Chuck