From owner-freebsd-questions Mon Feb 4 13:58:47 2002 Delivered-To: freebsd-questions@freebsd.org Received: from sage-american.com (sage-american.com [216.122.141.44]) by hub.freebsd.org (Postfix) with ESMTP id 3DBEC37B438 for ; Mon, 4 Feb 2002 13:58:14 -0800 (PST) Received: from SAGEONE (adsl-64-219-21-232.dsl.crchtx.swbell.net [64.219.21.232]) by sage-american.com (8.9.3/8.9.3) with SMTP id PAA13005; Mon, 4 Feb 2002 15:58:08 -0600 (CST) Message-Id: <3.0.5.32.20020204155805.01917078@mail.sage-american.com> X-Sender: jacks@mail.sage-american.com X-Mailer: QUALCOMM Windows Eudora Pro Version 3.0.5 (32) Date: Mon, 04 Feb 2002 15:58:05 -0600 To: Edwin Groothuis From: jacks@sage-american.com Subject: Re: Firewall Denies - w/info Cc: freebsd-questions@FreeBSD.ORG In-Reply-To: <20020205075442.O1599@k7.mavetju.org> References: <3.0.5.32.20020204135700.01917078@mail.sage-american.com> <3.0.5.32.20020204135700.01917078@mail.sage-american.com> Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Sender: owner-freebsd-questions@FreeBSD.ORG Precedence: bulk List-ID: List-Archive: (Web Archive) List-Help: (List Instructions) List-Subscribe: List-Unsubscribe: X-Loop: FreeBSD.ORG I changed the rules to the following for the DNS and seems to have fixed the DNS blocks. But, are "dynamic" rules now.... # ${fwcmd} add pass tcp from any to ${oip} 53 setup # ${fwcmd} add pass udp from any to ${oip} 53 # ${fwcmd} add pass udp from ${oip} 53 to any # ${fwcmd} add pass udp from ${oip} to any 53 keep-state At 07:54 AM 2.5.2002 +1100, Edwin Groothuis wrote: >On Mon, Feb 04, 2002 at 01:57:00PM -0600, jacks@sage-american.com wrote: >> Sheesh! Here are the denies with the questions again. Sorry! >> I'm getrting a lot of these "denies" of outgoing UDP shown in my firewall >> log. The lookups show they are NSLs or root.servers, but not MY >> nameservers. Many are on port 1024, but not always (some on the samba ports). >> >> Also, some try to go out on port 53, but not to MY nameservers.... >> >> Since it looks like the requests are coming from my machines, they look >> harmless & wonder if I need the requests, and what could be asking for the >> info. Does anyone know what these are for...??? ...or what is asking for >> the info? >> >> Deny UDP 64.xxx.xx.xxx:1024 198.41.0.4:53 out via tun0 >> Deny UDP 64.xxx.xx.xxx:1024 192.203.230.10:53 out via tun0 >> Deny UDP 64.xxx.xx.xxx:1024 192.36.148.17:53 out via tun0 >> Deny UDP 64.xxx.xx.xxx:1024 198.32.64.12:53 out via tun0 > >These are *from* your nameserver-process to the root-nameservers. >That's how the protocol is designed and works. Just open all the >ports from your nameserver to everywhere port 53, on both tcp and >udp, and your nameserver will work fine. > >Edwin > >-- >Edwin Groothuis | Personal website: http://www.MavEtJu.org >edwin@mavetju.org | Interested in MUDs? Visit Fatal Dimensions: >------------------+ http://www.FatalDimensions.org/ > >To Unsubscribe: send mail to majordomo@FreeBSD.org >with "unsubscribe freebsd-questions" in the body of the message > > Best regards, Jack L. Stone, Server Admin =================================================== Sage-American http://www.sage-american.com jacks@sage-american.com "My center is giving way, my right is in retreat; ....situation excellent! ....I shall attack!" =================================================== To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-questions" in the body of the message