Date: Mon, 2 Jan 2017 19:09:05 +0300 (MSK) From: Maxim Konovalov <maxim.konovalov@gmail.com> To: Warren Block <wblock@FreeBSD.org> Cc: doc-committers@freebsd.org, svn-doc-all@freebsd.org, svn-doc-head@freebsd.org Subject: Re: svn commit: r49600 - head/en_US.ISO8859-1/books/handbook/firewalls Message-ID: <alpine.BSF.2.20.1701021904430.83306@mp2.macomnet.net> In-Reply-To: <201610281531.u9SFVL7u096914@repo.freebsd.org> References: <201610281531.u9SFVL7u096914@repo.freebsd.org>
next in thread | previous in thread | raw e-mail | index | archive | help
Hi Warren, On Fri, 28 Oct 2016, 15:31-0000, Warren Block wrote: [...] > # Allow outbound NTP > -$cmd 00260 allow tcp from any to any 37 out via $pif setup keep-state > +$cmd 00260 allow udp from any to any 123 out via $pif setup keep-state > > # Allow outbound SSH > $cmd 00280 allow tcp from any to any 22 out via $pif setup keep-state > Are you sure about this change? NTP is UDP based protocol. In the same time "setup" is TCP only feature (why ipfw(8) allows it to use in conjunction with the UDP proto is a different story) I think the comment is what should be fixed here. -- Maxim Konovalov
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?alpine.BSF.2.20.1701021904430.83306>