steve at drifthost.com
Fri Oct 1 01:48:48 PDT 2004
I don't have an internal network.
This is a server with 1 gigabit network card on a gig link.
Im really confussed on whats happing then, because web browsing still works
but its blocking come packets..
I host 60sites+ so I cant pin it down to one site or nothing.
Anyone have any other ideas?
Steven Adams steve at drifthost.com
DriftNet Web Services http://www.drifthost.com
Home: +61 2 94274857
Fax: +61 2 94274857
Mobile +61 (0) 404 085644
From: Subhro [mailto:subhro.kar at gmail.com]
Sent: Friday, 1 October 2004 12:36 AM
To: drift at freebsd.org
Cc: steve at drifthost.com; freebsd-questions at freebsd.org
Subject: Re: IPFW Problem
On Thu, 30 Sep 2004 22:32:16 +1000, Steven Adams <steve at drifthost.com>
> When I add
> $fwcmd add allow ip from any to any established
> The messages go away, but when I remove it they come back, I ran a tcpdump
> it seems most of the packet just have ACK set?
If this works for you then the keep-state is definitely not working
for you. Because when a SYN comes in, the state is saved in the
firewall dynamic states so that subsequent ACKs corresponding to that
SYN gets through without any problem.
> $fwcmd -f flush
> $fwcmd add check-state
> $fwcmd add allow ip from any to any via lo0
> $fwcmd add deny ip from any to 127.0.0.0/8
> $fwcmd add deny all from any to any frag in via $oif
> $fwcmd add allow tcp from any to me
> in via $oif keep-state setup
> $fwcmd add allow tcp from any to me 80 setup keep-state
> $fwcmd add allow udp from me 53 to any keep-state
> $fwcmd add allow udp from any to any 53 keep-state
> $fwcmd add allow all from me to any out via $oif setup keep-state
> $fwcmd add deny all from any to any 137,138,139,67,68 in
> $fwcmd add deny log all from me to any 22
> $fwcmd add deny log all from any to any
change this to $fwcmd add deny log all from any to any in xmit $oif
BTW, any good reason not to trust your internal network from sending
data through the firewall?
Subhro Sankha Kar
School of Information Technology
Block AQ-13/1 Sector V
freebsd-questions at freebsd.org mailing list
To unsubscribe, send any mail to "freebsd-questions-unsubscribe at freebsd.org"
More information about the freebsd-questions