On May 24, 2005, at 2:25 PM, Stephane Raimbault wrote:
I hate to ask something silly, but you do have a check-state rule
somewhere, right?
it's not silly..., what's silly is now I'm asking how would I
check :) or what would the rule look like.
You've have an "ipfw add check-state" rule somewhere.
The rules you've added permit traffic in both directions, which
shouldn't be needed unless the stateful matching wasn't working
right. Anyway, you don't need to use stateful rules if you permit
traffic in both ways, but the possible tradeoff is making the
systems more accessible to scanning and some DoS attacks using
forged traffic.
Not using keep-state with UDP is quite reasonable, but you might
consider adding a "keep-state" with your TCP rules for port 53.
You should also be aware that your nameservers will want to make
outbound connections using TCP themselves sometimes....
you've actually kinda answered the other question I neglected to
ask... which is, would I really need the keep-state, since it
seemed to work without it being there when I did my testing earlier
today. Regarding adding keep-state to my tcp rule... would this
not do the same thing... ? am I confused... or is it just insecure
of doing it this way:
# Allow TCP through if setup succeeded
${fwcmd} add pass tcp from any to any established
Stateful matching of connections can be more secure than passing any
traffic which is established, but that depends on the other rules
which are being used. However, the IPFW manpage has a good
description of this:
The typical use of dynamic rules is to keep a closed firewall
configura-
tion, but let the first TCP SYN packet from the inside network
install a
dynamic rule for the flow so that packets belonging to that
session will
be allowed through the firewall:
ipfw add check-state
ipfw add allow tcp from my-subnet to any setup keep-state
ipfw add deny tcp from any to any
--
-Chuck
_______________________________________________
[email protected] mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-ipfw
To unsubscribe, send any mail to "[EMAIL PROTECTED]"
