From owner-freebsd-questions@FreeBSD.ORG  Fri Mar 10 10:45:52 2006
Return-Path: <owner-freebsd-questions@FreeBSD.ORG>
X-Original-To: freebsd-questions@freebsd.org
Delivered-To: freebsd-questions@freebsd.org
Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125])
	by hub.freebsd.org (Postfix) with ESMTP id 8AA9016A420
	for <freebsd-questions@freebsd.org>;
	Fri, 10 Mar 2006 10:45:52 +0000 (GMT)
	(envelope-from norgaard@locolomo.org)
Received: from strange.daemonsecurity.com
	(59.Red-81-33-11.staticIP.rima-tde.net [81.33.11.59])
	by mx1.FreeBSD.org (Postfix) with ESMTP id 1062143D46
	for <freebsd-questions@freebsd.org>;
	Fri, 10 Mar 2006 10:45:52 +0000 (GMT)
	(envelope-from norgaard@locolomo.org)
Received: from [172.24.8.84] (generic.atosorigin.es [212.170.156.200])
	by strange.daemonsecurity.com (Postfix) with ESMTP id 9855C2E041;
	Fri, 10 Mar 2006 11:45:57 +0100 (CET)
Message-ID: <4411593D.60507@locolomo.org>
Date: Fri, 10 Mar 2006 11:47:25 +0100
From: Erik Norgaard <norgaard@locolomo.org>
User-Agent: Thunderbird 1.5 (Windows/20051201)
MIME-Version: 1.0
To: Roman Serbski <mefystofel@gmail.com>
References: <cca5083b0602260715w2f4a9e49o494f2f537afca2db@mail.gmail.com>	
	<4402232A.8010908@locolomo.org>	
	<cca5083b0602270548s4147d332v5df89fdb9a0b7ccd@mail.gmail.com>	
	<44031DC4.6060804@locolomo.org>	
	<cca5083b0602271945q5ef76163m5712a386e3eb3008@mail.gmail.com>	
	<440C25FE.6050401@locolomo.org>
	<cca5083b0603092044n2c92a6cfo564fae129136594b@mail.gmail.com>
In-Reply-To: <cca5083b0603092044n2c92a6cfo564fae129136594b@mail.gmail.com>
Content-Type: text/plain; charset=ISO-8859-15; format=flowed
Content-Transfer-Encoding: 7bit
Cc: freebsd-questions@freebsd.org
Subject: Re: Help with IP Filter 4.1.8
X-BeenThere: freebsd-questions@freebsd.org
X-Mailman-Version: 2.1.5
Precedence: list
List-Id: User questions <freebsd-questions.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-questions>, 
	<mailto:freebsd-questions-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-questions>
List-Post: <mailto:freebsd-questions@freebsd.org>
List-Help: <mailto:freebsd-questions-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-questions>, 
	<mailto:freebsd-questions-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Fri, 10 Mar 2006 10:45:52 -0000

Roman Serbski wrote:
>> 1) Other udp services, are responces also blocked? you can for example
>> try ntp. If so, then it is likely a bug in ip-filter.
> 
> Yes. Same for other udp (I tested with ntp). The symptoms are the same
> - there is a hit on a rule allowing outgoing ntp, but then reply is
> blocked.

It should be possible to capture on the interface in promiscuous mode. 
(I recall an article on SecurityFocus considering this as a security 
hole as it actually allows you to circumvent the firewall).

Cheers, Erik