On Mon, 9 Dec 2024 11:09:14 +0100
Juraj Lutter <o...@freebsd.org> wrote:
> > On 8 Dec 2024, at 20:30, Ronald Klop <ron...@freebsd.org> wrote:
> >
> > Hi,
> >
> > I can reproduce your error.
> >
> > A cronjob which does a scp to another server didn't work anymore. When I go
> > back to the previous BE it works fine again.
> > Ipfw disable firewall also makes the scp work.
> >
> > Scp also seems to work fine if I replace the statefull firewall rules with
> > stateless "pass all from any to any".
>
> Have you tried to allow ICMP in both directions explicitly, in case of
> stateful rules?
>
> —
> Juraj Lutter
> o...@freebsd.org
I think would usually work for clients with some limited services
exposed to outside. IIUC, it basically allow all sessions from inside
and allows limited serivices configured with variables
via /etc/rc.conf[.local].
Some notes.
*Last actual changes in /usr/src/libexec/rc/rc.firewall was at
Jul.23, 2020.
https://github.com/freebsd/freebsd-src/commits/main/libexec/rc/rc.firewall
[cgit.freebsd.org seems to be unstable now.]
*Variable firewall_logif currently does not exist.
*Don't you need allowing 22/UDP, too, like below?
firewall_myservices="22/tcp 22/udp"
And if you're creating kernel config from scratch (such as copying from
GENERIC at some point and editing it), it's no longer adviced.
It's not robust for changes in GENERIC.
Instead, include GENERIC and describe changes you want.
An example (one of my test kernel config for a bit old stable).
===== Start example =====
include GENERIC
ident TEST15
nooptions DDB
nooptions GDB
nooptions INVARIANTS
nooptions INVARIANT_SUPPORT
nooptions WITNESS
nooptions WITNESS_SKIPSPIN
nooptions DEADLKRES
options CAM_IOSCHED_DYNAMIC
device sg
===== End example =====
--
Tomoaki AOKI <junch...@dec.sakura.ne.jp>
