Filtering established connection in ipfw

From: Tomi Kaistila (tomi.kaistila_at_datamike.org)
Date: 03/19/04

  • Next message: Mike Silbersack: "Re: Filtering established connection in ipfw" 
    To: <freebsd-net@freebsd.org>
Date: Fri, 19 Mar 2004 01:50:10 +0200

    Hello

    I've just sometime ago got a second computer, I installed FreebSD 5.2 on it,
    full installation and I'm on my way of making a server out of it. Basically
    from the beginning, I've been struggling with ipfw, to make up a good
    ruleset.

    I've enabled IPFIREWALL in the kernel. My philosophy is, if it's not in the
    rules deny it. I have a very strict ruleset at the moment, only allowing
    connections to certain services and all from designated ports. All other
    connections are denied. My problem is that this also hinders my use of
    Internet from this machine. Although I have a rule that allows all
    connection from the server to outside, many connections spawn a reply. i.e.
    if I ping an address, I must also enable icmp from the outside world to my
    machine to receive the reply.

    My question is, can I make a rule that allows such replies to pass the
    packet filter, but to drop if it is not such a reply or similar signal? I
    tried using the setup and established flags but either I did something wrong
    or it just didn't work out that way. 

    --
Tomi
_______________________________________________
freebsd-net@freebsd.org mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-net
To unsubscribe, send any mail to "freebsd-net-unsubscribe@freebsd.org"
  • Next message: Mike Silbersack: "Re: Filtering established connection in ipfw"

    Relevant Pages

    • Re: SBS 2003 IIS BASED SERVICES FAIL INTERMITTENTLY
      ... If I read your post correctly, you have a switch where the SBS ... Run DHCP server on your SBS, and set all client machine nics to dynamic. ... Once you have your nics configured, run the Connect to the Internet wizard, ... QUESTION1 - what is REFUSING CONNECTIONS? ...
      (microsoft.public.windows.server.sbs)
    • Re: SBS Exchange 2003: too many "Current Sessions" opened
      ... So far everything is good and now I'm just monitoring my exchange. ... get the SMTP service to stop hanging in the first place. ... won't have dead connections. ... work for now until I put into production new server hardware with sbs 2003 ...
      (microsoft.public.windows.server.sbs)
    • Re: SBS Exchange 2003: too many "Current Sessions" opened
      ... You really should go through the steps I posted and get the SMTP service to stop hanging in the first place. ... You'll be happier, you won't be clubbing your server every day with a kill script, and you won't have dead connections. ... You do *not* need to restart the server, ...
      (microsoft.public.windows.server.sbs)
    • Access 2007->SQL Server2005 "connection was forcibly closed",GNE 1
      ... I have a very big problem connecting an SQL ... changing number of clients using the SQL Server with this frontend at the ... connection pooling or if these connections are separated connections). ...
      (microsoft.public.sqlserver.connect)
    • Re: Reducing load for LAMP app?
      ... MySQL: as much as possible, he keeps query results in RAM, but ... His hoster says that Apache server is under significant load. ... Using apc is pretty much transparent, but memcached will require modifying your database abstraction layer using the memcached functions. ... With persistent connections, you must have the maximum number of connections *ever* required allocated *all of the time* - even if no one is using your server. ...
      (comp.lang.php)