kern/57492: Firewall can be disabled in securelevel 3

Bernd Luevelsmeyer bernd at
Thu Oct 2 04:40:11 PDT 2003

>Number:         57492
>Category:       kern
>Synopsis:       Firewall can be disabled in securelevel 3
>Confidential:   no
>Severity:       serious
>Priority:       low
>Responsible:    freebsd-bugs
>State:          open
>Class:          sw-bug
>Submitter-Id:   current-users
>Arrival-Date:   Thu Oct 02 04:40:09 PDT 2003
>Originator:     Bernd Luevelsmeyer
>Release:        FreeBSD 4.9-PRERELEASE i386
System: FreeBSD 4.9-PRERELEASE #0: Mon Sep 8 15:08:58 CEST 2003 i386

    init(8) says, you cannot change ipfw rules in securelevel 3.
    It is possible, though, to disable the entire firewall,
    effectively deleting all rules and adding a rule "pass all
    from any to any".

    On a machine that has a firewall and runs in securelevel 3,
    as root enter
      sysctl net.inet.ip.fw.enable=0
    You can now send and receive packets that otherwise would
    be rejected by the firewall.


More information about the freebsd-bugs mailing list