From owner-freebsd-security Tue Jul 25 17:59:10 2000 Delivered-To: freebsd-security@freebsd.org Received: from mail.rdc1.il.home.com (ha1.rdc1.il.home.com [24.2.1.66]) by hub.freebsd.org (Postfix) with ESMTP id 6D72B37BC03 for ; Tue, 25 Jul 2000 17:59:06 -0700 (PDT) (envelope-from stephen@math.missouri.edu) Received: from math.missouri.edu ([24.12.197.197]) by mail.rdc1.il.home.com (InterMail vM.4.01.03.00 201-229-121) with ESMTP id <20000726005905.KCTA23923.mail.rdc1.il.home.com@math.missouri.edu>; Tue, 25 Jul 2000 17:59:05 -0700 Message-ID: <397E37D9.AA26139@math.missouri.edu> Date: Tue, 25 Jul 2000 19:59:05 -0500 From: Stephen Montgomery-Smith X-Mailer: Mozilla 4.72 [en] (X11; I; Linux 2.2.14 i686) X-Accept-Language: en MIME-Version: 1.0 To: Mike Hoskins Cc: "Rodney W. Grimes" , freebsd-security@FreeBSD.ORG Subject: Re: Problems with natd and simple firewall References: Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: 7bit Sender: owner-freebsd-security@FreeBSD.ORG Precedence: bulk X-Loop: FreeBSD.org Mike Hoskins wrote: > > On Tue, 25 Jul 2000, Mike Hoskins wrote: > > > Aye... A thoroughly-commeneted 'dynamic' rc.firewall option may be the > > best thing to come out of all this. > > And, along those lines... Comments on the following, please. It attempts > to mimic 'simple' as closely as possible and use compatible terminology > for ease of comparison. > > + ${fwcmd} add allow ip from ${oip} to any keep-state > + ${fwcmd} add allow ip from ${inet}:{$imask} to any keep-state > + > ..................... > + # Allow DNS queries out in the world > + ${fwcmd} add pass udp from any 53 to ${oip} > + ${fwcmd} add pass udp from ${oip} to any 53 > + > + # Allow NTP queries out in the world > + ${fwcmd} add pass udp from any 123 to ${oip} > + ${fwcmd} add pass udp from ${oip} to any 123 > + I don't think the DNS and NTP stuff is necessary. Aren't they both covered by the first two rules? ------ Also, shouldn't NTP be > + ${fwcmd} add pass udp from any 123 to ${oip} 123 > + ${fwcmd} add pass udp from ${oip} 123 to any 123 and how about for the DNS stuff: > + # Allow DNS queries out in the world > + ${fwcmd} add pass udp from ${my-name-server} 53 to ${oip} > + ${fwcmd} add pass udp from ${oip} to ${my-name-server} 53 -- Stephen Montgomery-Smith Department of Mathematics, University of Missouri, Columbia, MO 65211 Phone 573-882-4540, fax 573-882-1869 http://www.math.missouri.edu/~stephen stephen@math.missouri.edu To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-security" in the body of the message