From owner-freebsd-doc@FreeBSD.ORG Fri Jan 21 12:40:28 2005 Return-Path: Delivered-To: freebsd-doc@hub.freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id F259316A4CE for ; Fri, 21 Jan 2005 12:40:27 +0000 (GMT) Received: from freefall.freebsd.org (freefall.freebsd.org [216.136.204.21]) by mx1.FreeBSD.org (Postfix) with ESMTP id 880F443D41 for ; Fri, 21 Jan 2005 12:40:27 +0000 (GMT) (envelope-from gnats@FreeBSD.org) Received: from freefall.freebsd.org (gnats@localhost [127.0.0.1]) by freefall.freebsd.org (8.13.1/8.13.1) with ESMTP id j0LCeRFc010295 for ; Fri, 21 Jan 2005 12:40:27 GMT (envelope-from gnats@freefall.freebsd.org) Received: (from gnats@localhost) by freefall.freebsd.org (8.13.1/8.13.1/Submit) id j0LCeR6j010294; Fri, 21 Jan 2005 12:40:27 GMT (envelope-from gnats) Resent-Date: Fri, 21 Jan 2005 12:40:27 GMT Resent-Message-Id: <200501211240.j0LCeR6j010294@freefall.freebsd.org> Resent-From: FreeBSD-gnats-submit@FreeBSD.org (GNATS Filer) Resent-To: freebsd-doc@FreeBSD.org Resent-Reply-To: FreeBSD-gnats-submit@FreeBSD.org, Brad Davis Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id EE73E16A4CE for ; Fri, 21 Jan 2005 12:32:23 +0000 (GMT) Received: from ender.liquidneon.com (ender.liquidneon.com [64.78.150.163]) by mx1.FreeBSD.org (Postfix) with ESMTP id 5BCE743D48 for ; Fri, 21 Jan 2005 12:32:23 +0000 (GMT) (envelope-from bdavis@house.so14k.com) Received: from localhost (localhost [127.0.0.1]) by ender.liquidneon.com (Postfix) with ESMTP id B31EF43E5 for ; Fri, 21 Jan 2005 05:32:20 -0700 (MST) Received: from ender.liquidneon.com ([127.0.0.1]) by localhost (ender.liquidneon.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 93280-01 for ; Fri, 21 Jan 2005 05:32:19 -0700 (MST) Received: from mccaffrey.house.so14k.com (gw.house.so14k.com [216.87.87.128]) by ender.liquidneon.com (Postfix) with ESMTP id 044AA43B0 for ; Fri, 21 Jan 2005 05:32:18 -0700 (MST) Received: by mccaffrey.house.so14k.com (Postfix, from userid 1001) id 88022E7B; Fri, 21 Jan 2005 05:32:18 -0700 (MST) Message-Id: <20050121123218.88022E7B@mccaffrey.house.so14k.com> Date: Fri, 21 Jan 2005 05:32:18 -0700 (MST) From: Brad Davis To: FreeBSD-gnats-submit@FreeBSD.org X-Send-Pr-Version: 3.113 Subject: docs/76533: Misc punctuation fixes for the FW chapter. X-BeenThere: freebsd-doc@freebsd.org X-Mailman-Version: 2.1.1 Precedence: list Reply-To: Brad Davis List-Id: Documentation project List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 21 Jan 2005 12:40:28 -0000 >Number: 76533 >Category: docs >Synopsis: Misc punctuation fixes for the FW chapter. >Confidential: no >Severity: non-critical >Priority: low >Responsible: freebsd-doc >State: open >Quarter: >Keywords: >Date-Required: >Class: doc-bug >Submitter-Id: current-users >Arrival-Date: Fri Jan 21 12:40:26 GMT 2005 >Closed-Date: >Last-Modified: >Originator: Brad Davis >Release: FreeBSD 4.10-STABLE i386 >Organization: >Environment: System: FreeBSD mccaffrey.house.so14k.com 4.10-STABLE FreeBSD 4.10-STABLE #0: Fri May 28 08:02:41 MDT 2004 root@mccaffrey.house.so14k.com:/usr/obj/usr/src/sys/MCCAFFREY i386 >Description: 1. Remove a space before a period. 2. Remove a space before a comma. 3. s/2/two/ 4. Fix spacing around a parentheses. 5. s/dns/DNS/ 6. Add note about using a cronjob to flush the rules every so often to prevent locking oneself out. 7. Add missing beginning. 8. Remove another space before a period. 9. Add a missing period 10. s/2/two/ 11. Ack! Remove the XXXBLAH I left and replace it with something useful. 12. s/\./:/ 13. Add a missing : 14. Fix wording. >How-To-Repeat: >Fix: --- doc-ori/en_US.ISO8859-1/books/handbook/firewalls/chapter.sgml Wed Jan 19 07:01:03 2005 +++ doc/en_US.ISO8859-1/books/handbook/firewalls/chapter.sgml Fri Jan 21 05:24:47 2005 @@ -336,8 +336,8 @@ method see: and - . + url="http://coombs.anu.edu.au/~avalon/ip-filter.html">. + The IPF FAQ is at . @@ -350,8 +350,8 @@ ipfilter_enable="YES" is used. The loadable module was created with logging enabled and the default pass all options. You do not need to compile IPF into - the &os; kernel just to change the default to block all - , you can do that by just coding a block all rule at + the &os; kernel just to change the default to block + all, you can do that by just coding a block all rule at the end of your rule set. @@ -521,8 +521,8 @@ IPMON In order for ipmon to work properly, the kernel option IPFILTER_LOG must be turned on. This command has - 2 different modes that it can be used in. Native mode is the default - mode when you type the command on the command line without the + two different modes that it can be used in. Native mode is the + default mode when you type the command on the command line without the flag. Daemon mode is for when you want to have a continuous @@ -595,11 +595,12 @@ To activate the changes to /etc/syslog.conf you can reboot or bump the syslog task into re-reading /etc/syslog.conf by running - /etc/rc.d/syslogd restart ( - kill -HUP PID in &os; 4.x. You get the PID (i.e. process - identifier) by listing the tasks with the ps -ax - command. Find syslog in the display and the PID is the number - in the left column). + /etc/rc.d/syslogd restart + (kill -HUP PID + in &os; 4.x. You get the PID (i.e. process identifier) by + listing the tasks with the ps -ax command. + Find syslog in the display and the PID is the number in the + left column). Do not forget to change /etc/newsyslog.conf to rotate the new log you just created above. @@ -708,7 +709,7 @@ ############# Start of IPF rules script ######################## oif="dc0" # name of the outbound interface -odns="192.0.2.11" # ISP's dns server IP address +odns="192.0.2.11" # ISP's DNS server IP address myip="192.0.2.7" # my static IP address from ISP ks="keep state" fks="flags S keep state" @@ -809,7 +810,10 @@ Warning, when working with the firewall rules, always, always do it from the root console of the system running the - firewall or you can end up locking your self out. + firewall or you can end up locking your self out. Or setup a + cronjob to flush the Firewall rules say every 5 minutes. + (This might not be acceptable for a corporate firewall, but + should be for a home firewall.) @@ -820,7 +824,7 @@ rule wins logic. For the complete legacy rule syntax description see the &man.ipf.8; manual page. - # is used to mark the start of a comment and may appear at + A # is used to mark the start of a comment and may appear at the end of a rule line or on its own line. Blank lines are ignored. @@ -1444,7 +1448,7 @@ NAT rules are loaded by using the ipnat command. Typically the NAT rules are stored - in /etc/ipnat.rules . See &man.ipnat.1 + in /etc/ipnat.rules. See &man.ipnat.1 for details. When changing the NAT rules after @@ -1535,7 +1539,7 @@ Enabling IP<acronym>NAT</acronym> To enable IPNAT add these statements to - /etc/rc.conf + /etc/rc.conf. To enable your machine to route traffic between interfaces: @@ -1561,12 +1565,14 @@ becomes a resource problem that may cause problems with the same port numbers being used many times across many NATed LAN PC's, causing collisions. There - are 2 ways to relieve this resource problem. + are two ways to relieve this resource problem. Assigning Ports to Use - XXXBLAH + + A normal NAT rule would look like: map dc0 192.168.1.0/24 -> 0.32 @@ -1672,12 +1678,12 @@ map dc0 10.0.10.0/29 -> 0/32 proxy port 21 ftp/tcp - This rule handles the FTP traffic from the gateway. + This rule handles the FTP traffic from the gateway: map dc0 0.0.0.0/0 -> 0/32 proxy port 21 ftp/tcp This rule handles all non-FTP traffic from the internal - LAN. + LAN: A map dc0 10.0.10.0/29 -> 0/32 @@ -1701,7 +1707,7 @@ NAT FTP proxy is used. Without the FTP Proxy you will need the following three - rules + rules: # Allow out LAN PC client FTP to public Internet # Active and passive modes @@ -1724,14 +1730,13 @@ logged coming in on port 21. The NAT FTP/proxy appears to remove its temp rules prematurely, before receiving the response from the remote FTP server - acknowledging the close. Posted problem report to ipf - mailing list. + acknowledging the close. A problem report was posted to the + IPF mailing list. - Solution is to add filter rule like this one to get rid + The solution is to add filter rule like this one to get rid of these unwanted log messages or do nothing and ignore FTP - inbound error messages in your log. Not like you do FTP - session to the public Internet all the time, so this is not - a big deal. + inbound error messages in your log. Most people don't do + outbound FTP too often. Block in quick on rl0 proto tcp from any to any port = 21 >Release-Note: >Audit-Trail: >Unformatted: