Date: Sat, 14 Feb 2004 19:42:28 -0600 From: Eric F Crist <ecrist@adtechintegrated.com> To: Jez Hancock <jez.hancock@munk.nu> Cc: 'FreeBSD questions List' <freebsd-questions@freebsd.org> Subject: Re: continued IPFW issues... (actually a lack of ability on my part) Message-ID: <200402141942.38712.ecrist@adtechintegrated.com> In-Reply-To: <20040215005925.GA50495@users.munk.nu> References: <20040214233615.GB38665@users.munk.nu> <000201c3f356$906d6010$6401a8c0@Nomad> <20040215005925.GA50495@users.munk.nu>
next in thread | previous in thread | raw e-mail | index | archive | help
--Boundary-02=_O6sLAiKXRyzs1yb Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable Content-Disposition: inline On Saturday 14 February 2004 06:59 pm, Jez Hancock wrote: > On Sat, Feb 14, 2004 at 05:59:14PM -0600, Eric F Crist wrote: > > On Sat, Feb 14, 2004 at 03:27:35PM -0600, Eric F Crist wrote: > > > I'm still having some sort of issues with ipfw rules on my server. > > > I've got a > > > cgi based irc client installed, and I can't connect. Also, it seems > > > > as if my > > > > > DNS server isn't able to send queries out. An ipfw show displays the > > > following for me: > > > > > > 00050 54632 4640473 allow ip from me to any > > > 00100 0 0 allow ip from any to any via lo0 > > > 00200 0 0 deny ip from any to 127.0.0.0/8 > > > 00300 0 0 deny ip from 127.0.0.0/8 to any > > > 00400 4027 351563 allow ip from 63.228.14.240/29 to me > > > 00500 2 80 allow ip from any to me dst-port 22 > > > 00600 2 80 allow ip from any to me dst-port 21 > > > 00700 388 25405 allow ip from any to me dst-port 25 > > > 00800 58 4944 allow ip from any to me dst-port 80 > > > 00900 2 80 allow ip from any to me dst-port 443 > > > 01000 2 80 allow ip from any to me dst-port 110 > > > 01100 54 4247 allow ip from any to me dst-port 53 > > > 01200 2 80 allow ip from any to me dst-port 6667 > > > 01300 2 80 allow ip from any to me dst-port 6668 > > > 01400 4 160 deny ip from not 63.228.14.240/29 to me dst-port > > > > 8080 > > > > > 65535 46432 7224466 deny ip from any to any > > > > > > Where is all that denied traffic coming from on the final rule? > > > > You are only allowing traffic in and not out - as Matthew Seaman > > mentioned in the last post in your previous thread, you should use > > 'keep-state' to keep track of the connections made to you. See the > > examples he provided in that thread. > > > > >From the manpage for ipfw: > > > > check-state > > Checks the packet against the dynamic ruleset. If a match > > is > > found, execute the action associated with the rule which > > gener- > > ated this dynamic rule, otherwise move to the next rule. > > Check-state rules do not have a body. If no check-state > > rule is > > found, the dynamic ruleset is checked at the first > > keep-state or > > limit rule. > > > > ... > > > > keep-state > > Upon a match, the firewall will create a dynamic rule, > > whose > > default behaviour is to match bidirectional traffic between > > source and destination IP/port using the same protocol. > > The rule > > has a limited lifetime (controlled by a set of sysctl(8) > > vari- > > ables), and the lifetime is refreshed every time a matching > > packet is found. > > > > When a connection is made to port 80 from an external host, with the > > 'keep-state' flag set on your rule for port 80 data transfer will be > > allowed in both directions to/from the external host to/from you on port > > 80 for a limited period. The check-state rule effectively 'shortcuts' > > the rest of the rules in the ruleset if a match is made for the external > > host for the given action (inbound connections to port 80 in this case). > > > > You'd need to do the same for each of the other ports you want to allow > > free connections to/from. > > > > Wouldn't my first rule: > > > > ipfw allow ip from me to any > > > > have fixed this problem? > > Sorry I missed that rule :( How about adding a log keyword to that last > deny rule temporarily just to see what exactly is being denied? Maybe I'm missing something somewhere, but I can't find anything about log = in=20 the man page. I tried: ipfw add 65534 add deny ip from any to any log and got this error: ipfw: unrecognised option [-1] log Thanks. =2D-=20 Eric F Crist AdTech Integrated Systems, Inc (612) 998-3588 --Boundary-02=_O6sLAiKXRyzs1yb Content-Type: application/pgp-signature Content-Description: signature -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.4 (FreeBSD) iD8DBQBALs6OzdyDbTMRQIYRAiz2AJ98a/YMToPSa3aEAnZyyn3GKBR3WwCfVti6 BV+2oiZF0sZBRKPd4bNEUWE= =cr4n -----END PGP SIGNATURE----- --Boundary-02=_O6sLAiKXRyzs1yb--
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?200402141942.38712.ecrist>