> You'll generally need to keep state on UDP when you
> play online games.
>
> If you're smart, you don't allow arbitrary UDP
> packets from the outside
> world into your network, but if you're playing
> Unreal or something, then
> all communication is via UDP, and you won't be able
> to play.
>
> The best solution is to allow all UDP traffic to
> _leave_, while keeping
> state. the keep-state remembers the ip/port
> information on the outgoing
> packets, and thus allows return packets to get back
> in (by matching the
> ip/port pair).
>
> Now, when you know the port, it doesn't really make
> sense to use
> keep-state, and all you're really doing is spamming
> your state tables.
>
> If you look in the /etc/rc.firewall that ships with
> FreeBSD, you'll see
> these rules (designed to handle running a DNS
> server):
> # Allow access to our DNS
> ${fwcmd} add pass tcp from any to ${oip} 53
> setup
> ${fwcmd} add pass udp from any to ${oip} 53
> ${fwcmd} add pass udp from ${oip} 53 to any
>
> Granted, it's three rules instead of 1, but it does
> not use your state
> tables unnecessarily (sp?)
>
Unless you have above the "#Allow access to our DNS"
rules-
${fwcmd} add pass udp from ${oip} to any keep-state
to allow all UDP to leave.
the first incoming packet to port 53 will match the
stateless rule
${fwcmd} add pass udp from any to ${oip} 53
but the reply will create a dynamic rule
because first match is
${fwcmd} add pass udp from ${oip} to any keep-state
_______________________________
Do you Yahoo!?
Declare Yourself - Register online to vote today!
http://vote.yahoo.com
_______________________________________________
[EMAIL PROTECTED] mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-questions
To unsubscribe, send any mail to "[EMAIL PROTECTED]"
