svn commit: r49600 - head/en_US.ISO8859-1/books/handbook/firewalls

[Warren Block]

On Mon, 2 Jan 2017, Maxim Konovalov wrote:

> Hi Warren,
>
> On Fri, 28 Oct 2016, 15:31-0000, Warren Block wrote:
>
> [...]
>>  # Allow outbound NTP
>> -$cmd 00260 allow tcp from any to any 37 out via $pif setup keep-state
>> +$cmd 00260 allow udp from any to any 123 out via $pif setup keep-state
>>
>>  # Allow outbound SSH
>>  $cmd 00280 allow tcp from any to any 22 out via $pif setup keep-state
>>
> Are you sure about this change?  NTP is UDP based protocol.  In the
> same time "setup" is TCP only feature (why ipfw(8) allows it to use in
> conjunction with the UDP proto is a different story)
>
> I think the comment is what should be fixed here.

https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=213365 suggested 
merely changing this to UDP 123.  I don't use IPFW, so can't verify 
the actual usage. Help would be appreciated.