From owner-freebsd-questions  Thu Jun  7 13: 6:59 2001
Delivered-To: freebsd-questions@freebsd.org
Received: from ren.sasknow.com (ren.sasknow.com [207.195.92.131])
	by hub.freebsd.org (Postfix) with ESMTP id 8936637B401
	for <freebsd-questions@FreeBSD.ORG>; Thu,  7 Jun 2001 13:06:54 -0700 (PDT)
	(envelope-from ryan@sasknow.com)
Received: from localhost (ryan@localhost)
	by ren.sasknow.com (8.9.3/8.9.3) with ESMTP id OAA02056;
	Thu, 7 Jun 2001 14:06:45 -0600 (CST)
	(envelope-from ryan@sasknow.com)
Date: Thu, 7 Jun 2001 14:06:45 -0600 (CST)
From: Ryan Thompson <ryan@sasknow.com>
To: Nick Rogness <nick@rogness.net>
Cc: Josh Thomas <jdt2101@ksu.edu>, freebsd-questions@FreeBSD.ORG
Subject: Re: IPFW rules and outward connections
In-Reply-To: <Pine.BSF.4.21.0106071617590.10693-100000@cody.jharris.com>
Message-ID: <Pine.BSF.4.21.0106071404080.67902-100000@ren.sasknow.com>
Organization: SaskNow Technologies [www.sasknow.com]
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
Sender: owner-freebsd-questions@FreeBSD.ORG
Precedence: bulk
List-ID: <freebsd-questions.FreeBSD.ORG>
List-Archive: <http://docs.freebsd.org/mail/> (Web Archive)
List-Help: <mailto:majordomo?subject=help> (List Instructions)
List-Subscribe: <mailto:majordomo?subject=subscribe%20freebsd-questions>
List-Unsubscribe: <mailto:majordomo?subject=unsubscribe%20freebsd-questions>
X-Loop: FreeBSD.ORG

Nick Rogness wrote to Ryan Thompson:

> On Thu, 7 Jun 2001, Ryan Thompson wrote:
> 
> > Josh Thomas wrote to freebsd-questions@FreeBSD.ORG:
> > 
> > > I am looking to set up a firewall to be closed to all incoming >
> > connections except for 20-22 (for ftp and ssh), and to allow all >
> > outward connections.  However, I'm having trouble specifically keeping
> > > the dynamically assigned ports above 1024 for normal usage open.  
> > ie, > http from other machines, ftp from other machines.
> > 
> [snip]
> > 
> > # OR, only allow connections to remote ports 1024-9999
> > ipfw 1000 allow ip from ${network} to any 1024-9999
> 		  ^^
> 		You need to be protocol specific, eg tcp,udp
> 	in order to specify ports or port ranges...unless that has
> 	changed.

Yes, thanks, you're right. Typing without thinking again. ;-)

- Ryan

-- 
  Ryan Thompson <ryan@sasknow.com>
  Network Administrator, Accounts

  SaskNow Technologies - http://www.sasknow.com
  #106-380 3120 8th St E - Saskatoon, SK - S7H 0W2

        Tel: 306-664-3600   Fax: 306-664-1161   Saskatoon
  Toll-Free: 877-727-5669     (877-SASKNOW)     North America


To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-questions" in the body of the message