Date: Fri, 6 Feb 2004 22:24:39 -0500 From: "JJB" <Barbish3@adelphia.net> To: "Chris Nowlin" <Chris.Nowlin@co.travis.tx.us>, <freebsd-questions@freebsd.org> Subject: RE: firewall rule(s) for ports and packages Message-ID: <MIEPLLIBMLEEABPDBIEGIEOLFJAA.Barbish3@adelphia.net> In-Reply-To: <s0237360.026@GWMAIL.co.travis.tx.us>
next in thread | previous in thread | raw e-mail | index | archive | help
The cvsup process uses port 5999 add this rule to # Allow out FBSD (make install & CVSUP) functions # Basically give user root "GOD" privileges. allow tcp from me to any out via $pif setup keep-state uid root $pif = interface facing the public internet -----Original Message----- From: owner-freebsd-questions@freebsd.org [mailto:owner-freebsd-questions@freebsd.org]On Behalf Of Chris Nowlin Sent: Friday, February 06, 2004 11:58 AM To: freebsd-questions@freebsd.org Subject: firewall rule(s) for ports and packages I'm trying out 5.1 and 5.2, and with each, I utilize IPFW2 for the firewall. My rules allow passive FTP from the server, but often this does not seem to cover me when adding ports. To temporarily solve this (each time with the intention to find the correct solution) I just add a rule at the top to allow tcp from any to any via any. When the port install is done, I delete that rule. This is certainly the way I've had to do it when adding ports inside a jail - even things that worked from the main server, don't get past the firewall from inside the jail. I use "to me" and "from me" to identify the server, which only has one network interface. It's listening on two IPs (after creating the jail, I had to ifconfig an alias for the interface) but I thought that "me" would imply any IP address the interface was listening to. Surely there is a better way. For the "me" part I can always have two rules, one allowing the appropriate traffic for each IP address (instead of just using "me") but what about a solution for the quick-fix when adding ports? Thanks, Chris _______________________________________________ freebsd-questions@freebsd.org mailing list http://lists.freebsd.org/mailman/listinfo/freebsd-questions To unsubscribe, send any mail to "freebsd-questions-unsubscribe@freebsd.org"
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?MIEPLLIBMLEEABPDBIEGIEOLFJAA.Barbish3>