svn commit: r49600 - head/en_US.ISO8859-1/books/handbook/firewalls
Maxim Konovalov
maxim.konovalov at gmail.com
Tue Jan 3 16:28:14 UTC 2017
> > Hi Warren,
> >
> > On Fri, 28 Oct 2016, 15:31-0000, Warren Block wrote:
> >
> > [...]
> > > # Allow outbound NTP
> > > -$cmd 00260 allow tcp from any to any 37 out via $pif setup
> > > keep-state
> > > +$cmd 00260 allow udp from any to any 123 out via $pif setup
> > > keep-state
> > >
> > > # Allow outbound SSH
> > > $cmd 00280 allow tcp from any to any 22 out via $pif setup
> > > keep-state
> > >
> > Are you sure about this change? NTP is UDP based protocol. In the
> > same time "setup" is TCP only feature (why ipfw(8) allows it to use in
> > conjunction with the UDP proto is a different story)
> >
> > I think the comment is what should be fixed here.
>
> https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=213365 suggested merely
> changing this to UDP 123. I don't use IPFW, so can't verify the actual usage.
> Help would be appreciated.
>
I'd remove the "setup" keyword from the command. Let me know if I can
go ahead with this change.
--
Maxim Konovalov
More information about the svn-doc-all
mailing list