Date: Wed, 27 Feb 2002 17:22:39 -0500 From: Bob K <melange@yip.org> To: freebsd-security@FreeBSD.ORG Subject: Re: allowing icmp still doesn't allow traceroute Message-ID: <20020227172238.K40253@yip.org> In-Reply-To: <20020227170928.A54682@cowbert.2y.net>; from sirmoo@cowbert.2y.net on Wed, Feb 27, 2002 at 05:09:28PM -0500 References: <20020227170928.A54682@cowbert.2y.net>
next in thread | previous in thread | raw e-mail | index | archive | help
On Wed, Feb 27, 2002 at 05:09:28PM -0500, Peter C. Lai wrote: > I have: > 00600 allow icmp from any to any > > for ipfw, and i still get sendto Permission denied when > I try to traceroute. > > I later also explicitly defined icmptypes 0,3,8,11,13 > and this does not solve the problem. > > any suggestions? Add a rule such as this one: add <number> unreach port udp from any to any 33434-33524 in recv <iface> -- Bob <melange@yip.org> | It's pretty good, if you don't think about it. To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-security" in the body of the message
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20020227172238.K40253>