Date: Sun, 25 Feb 2007 04:33:13 -0700 From: Curby <curby.public@gmail.com> To: freebsd-questions@freebsd.org Subject: ipfw questions Message-ID: <5d2f37910702250333u282334f4s2865ad3b50ef4042@mail.gmail.com>
next in thread | raw e-mail | index | archive | help
I'm using IPFW2 on a Mac, but hopefully these questions are general enough for this list. First, is there any reason not to prefer "from any to any" over "from any to me" when adding rules to allow access to local services? Some ipfw configurations I've found use "from any to any," which doesn't seem bad except that it's unnecessarily general. Also, there's a verrevpath option but Apple's default ruleset still uses the following: deny log ip from 127.0.0.0/8 to any in deny log ip from any to 127.0.0.0/8 in deny log ip from 224.0.0.0/3 to any in deny log tcp from any to 224.0.0.0/3 in Is it correct that verrevpath should make these redundant/obsolete? It'd be nice to have one rule instead of 4, but I'm wondering why Apple isn't using its own supported features. Thanks!
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?5d2f37910702250333u282334f4s2865ad3b50ef4042>