Date: Fri, 6 Dec 2002 10:27:12 +0200 (EET) From: "BigBrother (BigB3)" <bigbrother@bonbon.net> To: questions@FreeBSD.ORG Subject: Re: ipfw firewall help Message-ID: <20021206101835.Q10707-100000@bigb3server.bbcluster.gr> In-Reply-To: <bulk.91982.20021205232731@hub.freebsd.org>
next in thread | previous in thread | raw e-mail | index | archive | help
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 >ipfw add 108 allow tcp from any to xx.250.227.0/22 20,21,25,80,110 via >bge0 <snip> > >#Outbound from inside >ipfw add 109 check-state >ipfw add 110 allow tcp from xx.250.224.0/22 via bge0 keep-state >ipfw add 111 allow udp from xx.250.224.0/22 via bge0 keep-state >ipfw add 112 allow tcp from any to any established setup >#Machine specific ports >#Server NEWS 1 >ipfw add 120 allow tcp from any to xx.250.227.2 53 via bge0 >ipfw add 121 allow tcp from any to xx.250.227.3 53 via bge0 >ipfw add 122 allow tcp from any to xx.250.227.4 53 via bge0 >ipfw add 123 allow udp from any to xx.250.227.2 via bge0 >ipfw add 124 allow udp from any to xx.250.227.3 via bge0 >ipfw add 125 allow udp from any to xx.240.227.4 via bge0 <snip> >#Deny all after above allows - here we go >ipfw add 400 deny tcp from any to xx.250.227.0/22 via bge0 >ipfw add 410 deny udp from any to xx.250.227.0/22 via bge0 > > >Goal is if we're on any of the 227 subnetted machines and wish to do >anything on the internet that we be allowed to do so, such as ftp, >telnet, >browse the web, etc. 1)General tip when using firewalls, especially if you are having problems.. ALWAYS log the denied packets....so in ruleset 400 you should put a log statement. 2) When using firewall always remember that packets are usually two way packets..which means somebody connectes to your port and your port sends a reply. So rule 108 should also include a 'keep state' option or it should be immediately followed byt a ipfw add 108 allow tcp from xx.250.227.0/22 20,21,25,80,110 to any via bge 3) Your problem is located on a missing rule. You have rules for the 224 subnet but not for the 227 for outgoing... So you should also include a line ipfw add 113 allow all from xx.250.227.0/22 via bge keep-state 4) Also whatever is not specifically writen with 2 rules (one incoming and other outgoing) it should have a keep-state option. For example rule 120 it has only the incoming connection to 53. You dont allow the outgoing. So prefereably you should i) make two rules for it ii) use a keep-state directive Regards, BigB - --- We are being monitored..but there is a solution... Use PGP for signing and encrypting emails!!!! Download my public key at http://www.us.pgp.net -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.1 (FreeBSD) iD8DBQE98F9jGe/V3CxAyHoRAn+sAJ0X65d6o/+YrI1iLMq+mHvDxtCrdACffrMb Uz0a1/8Z6fgUOuspgXeOjVk= =Dh2k -----END PGP SIGNATURE----- To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-questions" in the body of the message
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20021206101835.Q10707-100000>