ipfw and ssh

[RW]

On Thursday 06 April 2006 02:50, Anthony M. Agelastos wrote:
> Hello everyone,
>
> Allow me to preface my problem by saying that I am very ignorant when
> it comes to networking. I do apologize if this is trivial. In any
> event, I enabled the "client" ifpw firewall located in /etc/
> rc.firewall. This appears to work well for my needs... except for one
> additional item. I need someone outside of my network to have SSH
> access to my machine. I know his/her IP address. So, I have added
> some additional items to rc.firewall for this. Here is what I added.
>
>          # Allow person SSH access
>          mip="xxx.xxx.xxx.xxx"
>          ${fwcmd} allow tcp from any to any 22 out setup keep-state
>          ${fwcmd} add pass tcp from ${mip} to me 22 setup limit src-
> addr 2

The client script is setup to handle tcp by static rules. If you want to mix 
static and dynamic tcp rules (ie limits)  you will need to add  a check-state 
line before the comment: "Allow TCP through if setup succeeded" otherwise 
your dynamic rules will never see any established traffic and will timeout.  
Also there is a static rule already  to allow all outgoing tcp connections, 
so you don't need a stateful one for port 22.

However, none of the above should prevent an ssh login. 

If I were you I'd start with just: 

${fwcmd} add pass tcp from any to any ssh setup

and work from there. You need to be methodical when troubleshooting firewalls.