Please Help with Confusion about ipfw rules.

Martin McCormick martin at dc.cis.okstate.edu
Thu Jul 26 14:15:24 UTC 2007


	This is a situation where I thought I knew more than I
actually do. I set up a new domain name server with a
client-type firewall after having tested it first, but there is
nothing like hundreds of thousands of packets per hour to show
the weak spots.

	I made the mistake of setting up keep-state rules both
coming and going and I now see ipfw complaining frequently about
too many dynamic rules. All I am really trying to do is give
crackers a lot of nothing to look at when scanning the ports on
the system. It isn't doing any NAT or routing, etc. I am not
sure if I really need any keep-state rules. The DNS needs to be
accessible to the world and be able to talk to the world on port
53 and that is all as far as bind is concerned.

	What I am confused about is when I actually need
keep-state rules and when a simple rule like:

	${fwcmd} add pass all from any to ${ip} 53

and

	${fwcmd} add pass all from ${ip} to any 53

That theoretically should leave port 53 wide open to all types
of in-bound and out-bound traffic.

Fortunately, the new system is still working, but I am afraid we
might be dropping some packets so I need to modify the port 53
access.

	Thanks for your help.

Martin McCormick WB5AGZ  Stillwater, OK 
Systems Engineer
OSU Information Technology Department Network Operations Group


More information about the freebsd-questions mailing list