Date: Wed, 27 Feb 2002 17:27:45 -0500 From: Bob K <melange@yip.org> To: freebsd-security@FreeBSD.ORG Subject: Re: allowing icmp still doesn't allow traceroute Message-ID: <20020227172744.L40253@yip.org> In-Reply-To: <20020227172238.K40253@yip.org>; from melange@yip.org on Wed, Feb 27, 2002 at 05:22:39PM -0500 References: <20020227170928.A54682@cowbert.2y.net> <20020227172238.K40253@yip.org>
next in thread | previous in thread | raw e-mail | index | archive | help
On Wed, Feb 27, 2002 at 05:22:39PM -0500, Bob K wrote: > On Wed, Feb 27, 2002 at 05:09:28PM -0500, Peter C. Lai wrote: > > I have: > > 00600 allow icmp from any to any > > > > for ipfw, and i still get sendto Permission denied when > > I try to traceroute. > > > > I later also explicitly defined icmptypes 0,3,8,11,13 > > and this does not solve the problem. > > > > any suggestions? > > Add a rule such as this one: > > add <number> unreach port udp from any to any 33434-33524 in recv <iface> Sigh, didn't read closely enough, sorry. That'll allow other people to traceroute to you. You want to allow UDP packets in that above range leaving your machine - this should do it: allow udp from any to any 33434-33524 out xmit <iface> (the "out xmit <iface>" part is optional, depending on the rest of your rules) -- Bob <melange@yip.org> | It's pretty good, if you don't think about it. To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-security" in the body of the message
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20020227172744.L40253>