Re: Sockets stuck in FIN_WAIT_1

Hi--

You didn't mention which version of FreeBSD you are running-- that's rather important info.

On May 28, 2008, at 3:13 PM, Robert Blayzor wrote:
ipfw:

00200 allow tcp from any to me 80 setup
00200 allow icmp from any to me icmptype 0,3,8,11
00200 deny log ip from any to me

Also, surely these can't be the only IPFW rules you are using? If you want to use stateful rules, you need a keep-state argument, and you shouldn't be combining allow rules and deny rules into the same ruleset number...

--
-Chuck

_______________________________________________
freebsd-stable@xxxxxxxxxxx mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-stable
To unsubscribe, send any mail to "freebsd-stable-unsubscribe@xxxxxxxxxxx"

Relevant Pages

  • Re: IPFW: Blocking me out. How to debug?
    ... add allow tcp from any to any ftp in setup ... Passive mode needs allowing connections to this port range ... add deny log ip from any to 0.0.0.0/8 in ...
    (freebsd-questions)
  • Re: IPFW: Blocking me out. How to debug?
    ... allow log tcp from any to any out established ... add allow udp from any to any domain out ... add allow tcp from any to any ssh in setup ... $add deny log tcp from any to any in via $setup ...
    (freebsd-questions)
  • Re: IPFW: Blocking me out. How to debug?
    ... allow tcp from any to any in established ... add allow udp from any 33434-34458 to any out ... add allow tcp from any to any ssh in setup ... someone else used 'deny log ip from any to any recv all' ...
    (freebsd-questions)
  • Re: IPFW: Blocking me out. How to debug?
    ... UDP 53 traffic with upstream nameservers, up to the root unless you're ... Given that you're checking TCP ... add allow tcp from any to any ftp in setup ... add deny log ip from any to 0.0.0.0/8 in ...
    (freebsd-questions)
  • Re: cannot ftp to my freebsd gateway/server
    ... Checkstate works for udp and tcp packets, ... The first rule will handle it fine, but again I'd add keep-state. ... add 00500 deny log all from 192.160.1.0/24 to any in via dc1 ...
    (comp.unix.bsd.freebsd.misc)