Re: Configuring PF

From: Loren M. Lang (lorenl_at_alzatex.com)
Date: 02/20/05

  • Next message: Loren M. Lang: "Re: probably a simple problem with permissions" 
    Date: Sun, 20 Feb 2005 06:23:39 -0800
To: Pat Maddox <pergesu@gmail.com>

    On Mon, Feb 14, 2005 at 09:32:25PM -0700, Pat Maddox wrote:
    > I want to install a firewall on my system. First of all, is PF the
    > one I should be using? It seems to get the most recommendations.
    >
    > I don't actually seem to have any problems configuring it - I just
    > have some problems testing the configuration. I can ssh to the box,
    > and I can access port 80...but I'd like to be able to just scan it to
    > quickly see what's up. When PF is disabled, I can nmap it in about 9
    > seconds. When I turn it on, it takes over 3 minutes to do. These
    > machines are on the same network, so the connection is obviously fast.

    This is a good thing, IMHO. Think about all those script kiddies
    sitting out there looking for a nice, juicy server to compromise. If it
    takes them 3 minutes to port scan your machine, they'll probably cancel
    it before it's finished and move on.

    I believe what's happening is that all ports that aren't open are
    configured to drop packets instead of reject them like is default.
    Reject means send back an error message saying port is closed where
    dropping just ignores it. The port scanner sends out a request and
    waits for a response, either "Hello," or "Sorry, I'm closed." It will
    wait quite a while before it decides that nothings there.

    >
    > Are there any good, pretty simple guides on setting up PF? I'm having
    > a tough time understanding what the rulesets all mean.
    > _______________________________________________
    > freebsd-questions@freebsd.org mailing list
    > http://lists.freebsd.org/mailman/listinfo/freebsd-questions
    > To unsubscribe, send any mail to "freebsd-questions-unsubscribe@freebsd.org" 

    -- 
I sense much NT in you.
NT leads to Bluescreen.
Bluescreen leads to downtime.
Downtime leads to suffering.
NT is the path to the darkside.
Powerful Unix is.
Public Key: ftp://ftp.tallye.com/pub/lorenl_pubkey.asc
Fingerprint: B3B9 D669 69C9 09EC 1BCD  835A FAF3 7A46 E4A3 280C
 
_______________________________________________
freebsd-questions@freebsd.org mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-questions
To unsubscribe, send any mail to "freebsd-questions-unsubscribe@freebsd.org"
  • Next message: Loren M. Lang: "Re: probably a simple problem with permissions"

    Relevant Pages

    • Re: Why use a firewall with dialup?
      ... SYN-ACK depending on the port. ... packets not to TCP port 22 or part of an outgoing connection plus block ... Bluescreen leads to downtime. ... Downtime leads to suffering. ...
      (freebsd-questions)
    • Re: ping question
      ... Why freebsd doesn't support it! ... port to freebsd. ... >> Bluescreen leads to downtime. ... >> Downtime leads to suffering. ...
      (freebsd-questions)
    • Re: Configuring PF
      ... >> have some problems testing the configuration. ... > takes them 3 minutes to port scan your machine, ... > Bluescreen leads to downtime. ... > Downtime leads to suffering. ...
      (freebsd-questions)
    • Re: Gettext wont install
      ... Try doing a make clean in the port directory and starting over. ... Bluescreen leads to downtime. ... Downtime leads to suffering. ...
      (freebsd-questions)
    • Re: Configuring services for unusual ports
      ... > How would I go about configuring my xinetd's kr5-telnet server on my red hat ... > can see from my signature file below, I've already got port 23 on my network ... Rerun the firewall configuration and select the port to be closed. ... > newsgroup for follow-up this post may get seen by enough people to get an ...
      (comp.os.linux.networking)