PF RULES! But mine doesn't ...

Fafa Hafiz Krantz fteg at london.com
Tue May 10 06:40:14 PDT 2005


> The rules I suggested are so that external machines can talk to your DNS
> server (querying about the domain it is authoritative for), and so that
> responses can get back to those machines.
> 
> Your nameserver, however, may also be trying to get requests out. When
> it does this, by default, it will use a random source-port. By
> specifying
> 
> options {
> 	query-source address * port 53;
> }
> 
> in your named.conf, your nameserver will _also_ use port 53 as the
> source port on any requests _that it originates_. (That's the
> distinction). If you do this, then you won't need port 53 mentioned in
> your other "keep state" rule.
> 
> I suspect that this might actually be the cause of your transient FTP
> concern; you should try modifying your nameserver config before you go
> any further.

Great :) Thanks man, I'll try that.
Isn't this something that ought to be in every named.conf?

What ports do it go to by default?

> (This assumes that your resolv.conf is configured to use the local
> machine as a nameserver in the first instance. If that is not the case,
> then you will still need the port 53 clause in your "DNS and NTP"
> section, because other programs will use random ports in an attempt to
> get DNS queries out into the wild.)

No, my resolv.conf contains my ISP's nameservers.

> Your ruleset looks pretty simple, to be honest.

I've heard many experts say 'your ruleset looks like shit',
maybe because they're jealous of my nice headers ;)

Ok, so now my named.conf's option looks like this:

options {
        directory "/etc/namedb";
        pid-file "/var/run/named/pid";
        query-source address * port 53;
};

Should I specify where to log to?
Because it doesn't log.

> I'm afraid that where the specifics of PF are concerned, I know nothing:
> the advice I've given you is just generic firewall stuff :-/ It looks to
> me like your PF config is set up to use some kind of FTP proxy running
> on localhost:8021. On the other hand, I could be barking up the wrong
> tree completely; I've pretty much run out of useful things to say about
> this config.

Well you do seem to me like a jack of all trades.

Have a wonderful day! :)

--

Fafa Hafiz Krantz
  Research Designer @ http://www.home.no/barbershop
  Enlightened @ http://www.home.no/barbershop/smart/sharon.pdf



-- 
___________________________________________________________
Sign-up for Ads Free at Mail.com
http://promo.mail.com/adsfreejump.htm



More information about the freebsd-questions mailing list