Re: IPFW: Blocking me out. How to debug?


On Thu, December 20, 2007 1:39 am, W. D. wrote:

I'm no expert on firewalls, so take this with a grain of salt.

# Loopback:
# Allow anything on the local loopback:
add allow all from any to any via lo0
add deny ip from any to 127.0.0.0/8
add deny ip from 127.0.0.0/8 to any
Nope.
# Allow established connections:
add allow tcp from any to any established
Nope.
# Deny fragmented packets:
add deny ip from any to any frag


Perhaps this is the issue? I would think that if an IP fragment comes in,
it's specifically *not* an established TCP connection (yet), so it would
be blocked by this rule. No IP fragments means they don't have a chance
to be reassembled into an actual packet.

All the profiles in rc.firewall specifically allow ip frags, so I'd think
they're required.

Could anyone please throw this tired dog a bone?

Fetch! :)

--
Matt Piechota
_______________________________________________
freebsd-security@xxxxxxxxxxx mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-security
To unsubscribe, send any mail to "freebsd-security-unsubscribe@xxxxxxxxxxx"

Relevant Pages

  • Re: ipchains help
    ... you specifically block ONLY tcp connection attempts. ... You cannot block all UDP if you want DNS to ... forward DENY ...
    (Security-Basics)
  • Hi
    ... Did anyone knows how to deny the TCP connection Without using ... hosts.deny and ipfilter. ... With Regards ...
    (freebsd-questions)