From owner-freebsd-questions Mon Dec 31 3:18:46 2001 Delivered-To: freebsd-questions@freebsd.org Received: from cactus.fi.uba.ar (cactus.fi.uba.ar [157.92.49.108]) by hub.freebsd.org (Postfix) with ESMTP id 87C8437B428 for ; Mon, 31 Dec 2001 03:18:43 -0800 (PST) Received: from cactus.fi.uba.ar (cactus.fi.uba.ar [157.92.49.108]) by cactus.fi.uba.ar (8.11.6/8.11.6) with ESMTP id fBVBGca65200; Mon, 31 Dec 2001 08:16:39 -0300 (ART) (envelope-from fgleiser@cactus.fi.uba.ar) Date: Mon, 31 Dec 2001 08:16:38 -0300 (ART) From: Fernando Gleiser To: Kjell Cc: Subject: Re: ipf/ipnat rules for telnetting ADSL modem In-Reply-To: <20011231074149.E20DF7E20@mail.broadpark.no> Message-ID: <20011231075211.V64709-100000@cactus.fi.uba.ar> MIME-Version: 1.0 Content-Type: TEXT/PLAIN; charset=US-ASCII Sender: owner-freebsd-questions@FreeBSD.ORG Precedence: bulk List-ID: List-Archive: (Web Archive) List-Help: (List Instructions) List-Subscribe: List-Unsubscribe: X-Loop: FreeBSD.ORG On Mon, 31 Dec 2001, Kjell wrote: > List members! > My firewall needs to telnet my Cisco ADSL modem to obtain the current IP > address. What would be a secure set of ipfilter/ipnat rules considering that > I would not like the world to telnet into my firewall? > Regards from Kjell/LA3SG If you want to telnet *from* your firewall, you don't need to open telnet on your firewall. Add: pass out quick on proto tcp from to port = 23 flags S keep state Remember to add a default block rule: block in quick all where outif is the name of the outside interface, fwip is Ip of that interface, and modemip is the IP of your modem. Fer > > To Unsubscribe: send mail to majordomo@FreeBSD.org > with "unsubscribe freebsd-questions" in the body of the message > To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-questions" in the body of the message