continued IPFW issues... (actually a lack of ability on my part)

[Eric F Crist]

On Saturday 14 February 2004 08:09 pm, Erik Trulsson wrote:
> On Sat, Feb 14, 2004 at 08:01:07PM -0600, Eric F Crist wrote:
> > My bad, I found the log entry after your prodding.  After enabling
> > logging in the ruleset and enabling the sysctl variable, I get the
> > following output in a tail /var/log/security:
> >
> > Feb 14 19:59:44 grog kernel: ipfw: 65534 Deny UDP 192.168.0.1:51598
> > 255.255.255.255:61112 in via dc0
> > Feb 14 19:59:45 grog kernel: ipfw: 65534 Deny UDP 204.147.80.1:53
> > 63.228.14.241:49152 in via dc0
> > Feb 14 19:59:46 grog kernel: ipfw: 65534 Deny UDP 204.127.202.4:53
> > 63.228.14.241:49152 in via dc0
> > Feb 14 19:59:50 grog kernel: ipfw: 65534 Deny UDP 192.168.0.1:51599
> > 255.255.255.255:61112 in via dc0
> > Feb 14 19:59:55 grog kernel: ipfw: 65534 Deny UDP 204.127.202.4:53
> > 63.228.14.241:49152 in via dc0
> > Feb 14 19:59:56 grog kernel: ipfw: 65534 Deny UDP 192.168.0.1:51600
> > 255.255.255.255:61112 in via dc0
> > Feb 14 19:59:59 grog kernel: ipfw: 65534 Deny UDP 204.147.80.5:53
> > 63.228.14.241:49152 in via dc0
> > Feb 14 20:00:02 grog kernel: ipfw: 65534 Deny UDP 204.147.80.5:53
> > 63.228.14.241:49152 in via dc0
> > Feb 14 20:00:02 grog kernel: ipfw: 65534 Deny UDP 192.168.0.1:51601
> > 255.255.255.255:61112 in via dc0
> > Feb 14 20:00:03 grog kernel: ipfw: 65534 Deny UDP 204.147.80.1:53
> > 63.228.14.241:49152 in via dc0
> >
> > I would assume I need to enable a rule such as:
> >
> > ipfw add allow udp from any to me 53
> >
> > Is this correct?  TIA
>
> I don't think so.
> The entries of the form 'Deny UDP 204.147.80.1:53 63.228.14.241:49152
> in via dc0' would appear to be replies to your DNS queries.
> They go to the port from which the DNS query was sent (49152 in this
> case).
>
> You need to make sure that you allow replies to connections you
> initiate to get through.
>
> Take a look at the check-state/established/keepstate stuff people have
> repeatedly told you to use. They are probably what you want.

Well, from what I understand, isn't udp a state-less protocol?  How would 
established/keepstate/check-state work with that?



-- 
Eric F Crist
AdTech Integrated Systems, Inc
(612) 998-3588
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 187 bytes
Desc: signature
Url : http://lists.freebsd.org/pipermail/freebsd-questions/attachments/20040214/efeced7d/attachment-0001.bin