Date: Tue, 10 May 2005 05:09:59 -0500 From: "Fafa Hafiz Krantz" <fteg@london.com> To: "Jan Grant" <Jan.Grant@bristol.ac.uk> Cc: questions@freebsd.org Subject: Re: PF RULES! But mine doesn't ... Message-ID: <20050510101000.494C64BEAD@ws1-1.us4.outblaze.com>
next in thread | raw e-mail | index | archive | help
> It's a question of letting DNS traffic _in_ to your nameserver: > > pass in on $ext_if inet proto { tcp, udp } \ > from any to ($ext_if) port 53 >=20 > ^^^ that lets the traffic in.... >=20 > pass out on $ext_if inet proto { tcp, udp } \ > from ($ext_if) port 53 to any >=20 > ^^^ and that lets it back out. >=20 > If you add the "query-source address * port 53;" to your named.conf > "options" section, that'll suffice; additionally, since your DNS query > source port is then predictable, you can drop it from the DNS and NTP > rule. Hello again, Jan! Well, I tried applying what you said now as well as last time you said it -- but the problem is still there. Unless I uncomment the default deny policy nothing seems to work. The problem must lie elsewhere in my ruleset: int_if=3D"ep0" ext_if=3D"lnc0" # *** Options # set block-policy drop # *** Scrub incoming packets # scrub in all # *** NAT # nat on $ext_if from $int_if:network to any -> ($ext_if) rdr on $int_if proto tcp from any to any \ port 21 -> 127.0.0.1 port 8021 # *** Default deny policy # # block drop log all # *** Pass loopback traffic # pass quick on { lo0 $int_if } # *** Outgoing # pass out on $ext_if inet proto { tcp, udp, icmp } \ from ($ext_if) to any keep state # *** DNS # pass in on $ext_if inet proto { tcp, udp } \ from any to ($ext_if) port 53 pass out on $ext_if inet proto { tcp, udp } \ from ($ext_if) port 53 to any # *** NTP # pass out on $ext_if inet proto udp \ from ($ext_if) to any port { 53, 123 } keep state # *** SSH, HTTP and Ident # pass in on $ext_if inet proto tcp \ from any to ($ext_if) port { 22, 80, 113 } flags S/SA keep state # *** Active FTP # pass in on $ext_if inet proto tcp \ from port 20 to ($ext_if) user proxy flags S/SA keep state # *** Private FTP # pass in on $ext_if proto tcp \ from any to any port 31337 keep state pass in on $ext_if proto tcp \ from any to any port 53333:55555 -- Fafa Hafiz Krantz Research Designer @ http://www.home.no/barbershop Enlightened @ http://www.home.no/barbershop/smart/sharon.pdf --=20 ___________________________________________________________ Sign-up for Ads Free at Mail.com http://promo.mail.com/adsfreejump.htm
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20050510101000.494C64BEAD>