Date: Mon, 24 May 2004 17:00:33 +0300 From: Giorgos Keramidas <keramida@ceid.upatras.gr> To: "Thomas T. Veldhouse" <veldy@veldy.net> Cc: freebsd-questions@freebsd.org Subject: Re: Repeated connections to port 25 with firewall Message-ID: <20040524140033.GA3461@gothmog.gr> In-Reply-To: <001501c44195$e2ac4610$321d590a@nic.target.com> References: <20040524122957.GA47602@dogma.freebsd-uk.eu.org> <001501c44195$e2ac4610$321d590a@nic.target.com>
next in thread | previous in thread | raw e-mail | index | archive | help
On 2004-05-24 08:49, "Thomas T. Veldhouse" <veldy@veldy.net> wrote: > From: "Jonathon McKitrick" <jcm@FreeBSD-uk.eu.org> > > > > This is probably a simple question with a simple answer, but I > > wasn't sure where to look. [snip] > You should allow all traffic on your loopback device by default. > Much like this (for IPFILTER) > > pass in quick on lo0 all > pass out quick on lo0 all Very true. I do prefer writing this to explicitly allow only packets from/to 127.0.0.1/32 though: IPFW syntax ----------- add allow ip from 127.0.0.1/32 to 127.0.0.1/32 via lo0 add deny ip from 127.0.0.0/8 to any add deny ip from any to 127.0.0.0/8 ipfilter syntax --------------- block in from any to any block out from any to any pass in quick from 127.0.0.1/32 to 127.0.0.1/32 on lo0 pass out quick from 127.0.0.1/32 to 127.0.0.1/32 on lo0 I've even been tempted to try blocking everything on lo0 and explicitly allowing only a few selected ports/protocols. But that's paranoid :-P - Giorgos
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20040524140033.GA3461>