Minor rpc question ....

[William A. Mahaffey III]

On 11/02/14 11:12, Ian Smith wrote:
> William, I've just seen your response at
> http://lists.freebsd.org/pipermail/freebsd-questions/2014-November/262026.html
> but as I take questions@ as a digest, I won't get it here till tomorrow
> .. I should have asked you to cc me.
>
> So this is a brief hatchet job:
>
>   > 02500  18777 23476935 allow tcp from 192.168.0.0/16 to me
>   > 65000   1795   424041 count ip from any to any
>   > 65100   1371   269257 deny { tcp or udp } from any to any dst-port 111,137,138,513 in
>
>   > w/ port 513 obviously being denied. However, I don't know where that
>   > is happening :-/ & I thought rule 02500 would let all local traffic
>   > through ....
>
> /etc/rc.firewall 'workstation' ruleset allows you to enable inbound
> access to services, like rwhod.  see /etc/defaults/rc.conf for details
> of rc.conf variables, and rc.firewall for how they're invoked.
>
> Rule 2500 only allows tcp, rwho is udp - but 2500 is a bit sweeping
> anyway, perhaps best to enable specific services, even internally?

I did that to start w/ & had trouble getting stuff (NFS) to run, so I 
just opened up all internal traffic, a bit shaky, on my TODO list to 
fix, might be a good time now :-) ....

>
> Ah, yes - I see firewall_myservices and firewall_allowservices are only
> for TCP services.  That's a strange omission, if I'm reading it right,
> especially re rpc.
>
> Rather than fixing this properly now for UDP services, I'd just add into
> /etc/rc.firewall after what's now your 2500 or at any rate before 65000:
>
> ${fwcmd} allow udp from ${mynetwork} 513 to me 513
>
> You're already enabling udp services outbound, statefully, which is why
> you can query other hosts.  Now they'll be able to reach you too :)
>
> 'service ipfw restart' and you should be good to go.  You could remove
> 513 from firewall_nologports - but now it'll already be passed by then.
>
> g'night, Ian
>


-- 

	William A. Mahaffey III

  ----------------------------------------------------------------------

	"The M1 Garand is without doubt the finest implement of war
	 ever devised by man."
                            -- Gen. George S. Patton Jr.