Re: IPFW rules

SigmaX asdf wrote:
I'm trying to setup IPFW to block all ports except those I specify.
For starters I'm just opening SSH.

# ipfw list
00050 divert 8668 ip4 from any to any via rl0
00100 allow ip from any to any via lo0
00200 deny ip from any to 127.0.0.0/8
00300 deny ip from 127.0.0.0/8 to any
00301 allow log tcp from any to any dst-port 22
00399 deny ip from any to any
65000 allow ip from any to any
65535 deny ip from any to any

Traffic is still blocked on port 22 -- I can't login via SSH. What am
I doing wrong, and what rule should I be using to allow SSH in and
through?


You need to allow the return traffic. Either something like:

ipfw add 1 allow tcp from any to any established

or:

ipfw add 1 check-state

and change your port 22 rule to read

ipfw allow log tcp from any to any port 22 keep-state


(check the ipfw(8) man page to be sure, I haven't touched ipfw rules in
a long time and my above syntax may be a bit buggy)


-Proto
_______________________________________________
freebsd-stable@xxxxxxxxxxx mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-stable
To unsubscribe, send any mail to "freebsd-stable-unsubscribe@xxxxxxxxxxx"

Relevant Pages

  • problem in smtp server
    ... FTP and the e-mail for the domain with qmail. ... All seems to work fine if i disable the ipfw... ... $cmd 00010 allow all from any to any via lo0 ... $cmd 00299 deny log all from any to any out via $pif ...
    (comp.unix.bsd.freebsd.misc)
  • Trouble with ipfw :( help!
    ... I have configured ipfw on my mail server... ... 00200 deny ip from any to 127.0.0.0/8 ... 00800 allow tcp from any to me dst-port 25,110,995,143,993 setup ...
    (freebsd-questions)
  • IPFW, NATd, dnscache problems
    ... I can't for the life of me get port forwarding setup. ... part is that ipfw is seeing the request come in (the appropriate rule's ... interface dc0 ... ipfw -q add 00301 deny log all from any to 127.0.0.0/8 ...
    (comp.unix.bsd.freebsd.misc)
  • Re: Problems with ipfw and ssh
    ... the rule you have set to allow any, my same rule is deny any. ... I know I had some issues with IPFW working for about 15 minutes, ... However I stuck with the ssh rule since i mainly want to work remotely on ... On Thursday 12 October 2006 20:22, Spiros Papadopoulos wrote: ...
    (freebsd-questions)
  • Re: ipfw
    ... HAVING to add ipfw add allow ip from any to any gets process before I would allow my 1 machine to port 113, thus allowing every machine to port 113 ... >> which allows everything despite ANY DENY chains. ... secure email at http://www.medmail.com - ...
    (FreeBSD-Security)