From owner-freebsd-questions@FreeBSD.ORG  Sun Jan 18 15:47:06 2004
Return-Path: <owner-freebsd-questions@FreeBSD.ORG>
Delivered-To: freebsd-questions@freebsd.org
Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125])
	by hub.freebsd.org (Postfix) with ESMTP id 6F23416A4CE
	for <freebsd-questions@freebsd.org>;
	Sun, 18 Jan 2004 15:47:06 -0800 (PST)
Received: from stork.mail.pas.earthlink.net (stork.mail.pas.earthlink.net
	[207.217.120.188])
	by mx1.FreeBSD.org (Postfix) with ESMTP id 83A9743D31
	for <freebsd-questions@freebsd.org>;
	Sun, 18 Jan 2004 15:47:05 -0800 (PST)
	(envelope-from algould@datawok.com)
Received: from 22-15.lctv-b4.cablelynx.com ([24.204.22.15]
	helo=yoda.datawok.com)
	by stork.mail.pas.earthlink.net with asmtp (TLSv1:RC4-MD5:128)
	(Exim 3.33 #1)	id 1AiMdD-0006vD-00
	for freebsd-questions@freebsd.org; Sun, 18 Jan 2004 15:47:03 -0800
From: "Andrew L. Gould" <algould@datawok.com>
To: freebsd-questions@freebsd.org
Date: Sun, 18 Jan 2004 17:47:04 -0600
User-Agent: KMail/1.5.4
MIME-Version: 1.0
Content-Type: text/plain;
  charset="us-ascii"
Content-Transfer-Encoding: 7bit
Content-Disposition: inline
Message-Id: <200401181747.04419.algould@datawok.com>
X-ELNK-Trace: ee791d459e3d6817d780f4a490ca69564776905774d2ac4ba47129c035f3a1bcb03ce1a1b140221a350badd9bab72f9c350badd9bab72f9c350badd9bab72f9c
Subject: ipfw rules for letting ssh requests in
X-BeenThere: freebsd-questions@freebsd.org
X-Mailman-Version: 2.1.1
Precedence: list
List-Id: User questions <freebsd-questions.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-questions>,
	<mailto:freebsd-questions-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-questions>
List-Post: <mailto:freebsd-questions@freebsd.org>
List-Help: <mailto:freebsd-questions-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-questions>,
	<mailto:freebsd-questions-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Sun, 18 Jan 2004 23:47:06 -0000

I can't seem to get the ipfw rules right for letting ssh clients access a ssh 
server.  I can use ssh on the server to connect to the client; but if I try 
to connect from the client to the server, the operation times out.

I have my rules in /etc/ipfw.rules.  Executing 'ipfw show' displays all of the 
rules as expected.  It also shows packets having been allowed at rule 300 
after an attempt to connect has been made.

I have copied the top portion of /etc/ipfw.rules:

#!/bin/sh

# Andrew L. Gould's firewall rules.

fwcmd="/sbin/ipfw -q"
${fwcmd} -f flush


# Basic rules that should not be changed
${fwcmd} add 00100 pass all from any to any via lo0
${fwcmd} add 00110 deny all from any to 127.0.0.0/8
${fwcmd} add 00120 deny ip from 127.0.0.0/8 to any


# Allow specified service requests in
# ssh
${fwcmd} add 00300 allow tcp from any to me 22
${fwcmd} add 00301 allow udp from any to me 22
##########################################

Does anyone have any idea why the operation is timing out or what I have done 
wrong?

Thanks,

Andrew Gould