From owner-freebsd-security Wed Jul 17 5:16:42 2002 Delivered-To: freebsd-security@freebsd.org Received: from mx1.FreeBSD.org (mx1.FreeBSD.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id E5ADA37B400 for ; Wed, 17 Jul 2002 05:16:39 -0700 (PDT) Received: from doos.cluecentral.net (cluecentral.net [193.109.122.221]) by mx1.FreeBSD.org (Postfix) with SMTP id 3672B43E58 for ; Wed, 17 Jul 2002 05:16:38 -0700 (PDT) (envelope-from sabri@cluecentral.net) Received: (qmail 83731 invoked by uid 1000); 17 Jul 2002 12:16:29 -0000 Received: from localhost (sendmail-bs@127.0.0.1) by localhost with SMTP; 17 Jul 2002 12:16:29 -0000 Date: Wed, 17 Jul 2002 14:16:29 +0200 (CEST) From: Sabri Berisha To: Bart Matthaei Cc: "Carroll, D. (Danny)" , Subject: Re: ipfw and it's glory... In-Reply-To: <20020717120231.GB40276@heresy.dreamflow.nl> Message-ID: <20020717141338.M82632-100000@doos.cluecentral.net> X-NCC-Regid: nl.bit X-No-Archive: yes Approved: sabri@pfy.nl MIME-Version: 1.0 Content-Type: TEXT/PLAIN; charset=US-ASCII Sender: owner-freebsd-security@FreeBSD.ORG Precedence: bulk List-ID: List-Archive: (Web Archive) List-Help: (List Instructions) List-Subscribe: List-Unsubscribe: X-Loop: FreeBSD.org On Wed, 17 Jul 2002, Bart Matthaei wrote: > On Wed, Jul 17, 2002 at 01:57:40PM +0200, Carroll, D. (Danny) wrote: > > :Some things tend to break when you leave it out. I can't give you any > > :examples atm, since I don't recall them :) How about DNS? You send out a query from an high udp port to a dns server's port 53. It will send you an udp packet to that high port. > > Been in that world of hurt but I managed to get everything *I* need... > > (FTP, IRC, ICQ) > > The only exception was LiveUpdate for Symantec. > > > > Punch_FW with natd works for me in these cases, but without nat running > > I guess it would be harder. > > Natd on a firewall ? Firewalling a public network ? I don't think so > :) Nothing wrong with that. In fact, you might even want to consider using natd only if you don't use the box for another purpose. -- Sabri Berisha - www.megabit.nl - "I route, therefore you are" - http://www.fordreallysucks.com/more_info.html - 'that particular feeding of Martijn Bevelander, notorious spammer and whiney repeat-posting troll, was almost a work of art.' (nanae) To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-security" in the body of the message