firewall rule(s) for ports and packages

Chris Nowlin Chris.Nowlin at
Fri Feb 6 09:56:34 PST 2004

I'm trying out 5.1 and 5.2, and with each, I utilize IPFW2 for the
firewall. My rules allow passive FTP from the server, but often this
does not seem to cover me when adding ports. To temporarily solve this
(each time with the intention to find the correct solution) I just add a
rule at the top to allow tcp from any to any via any. When the port
install is done, I delete that rule.

This is certainly the way I've had to do it when adding ports inside a
jail - even things that worked from the main server, don't get past the
firewall from inside the jail. I use "to me" and "from me" to identify
the server, which only has one network interface. It's listening on two
IPs (after creating the jail, I had to ifconfig an alias for the
interface) but I thought that "me" would imply any IP address the
interface was listening to.

Surely there is a better way. For the "me" part I can always have two
rules, one allowing the appropriate traffic for each IP address (instead
of just using "me") but what about a solution for the quick-fix when
adding ports?


More information about the freebsd-questions mailing list