Re: svn commit: r49600 - head/en_US.ISO8859-1/books/handbook/firewalls
Maxim Konovalov <[email protected]>
| Newsgroups | gmane.os.freebsd.devel.cvs.doc |
|---|---|
| Message-ID | <[email protected]> |
> > Hi Warren, > > > > On Fri, 28 Oct 2016, 15:31-0000, Warren Block wrote: > > > > [...] > > > # Allow outbound NTP > > > -$cmd 00260 allow tcp from any to any 37 out via $pif setup > > > keep-state > > > +$cmd 00260 allow udp from any to any 123 out via $pif setup > > > keep-state > > > > > > # Allow outbound SSH > > > $cmd 00280 allow tcp from any to any 22 out via $pif setup > > > keep-state > > > > > Are you sure about this change? NTP is UDP based protocol. In the > > same time "setup" is TCP only feature (why ipfw(8) allows it to use in > > conjunction with the UDP proto is a different story) > > > > I think the comment is what should be fixed here. > > https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=213365 suggested merely > changing this to UDP 123. I don't use IPFW, so can't verify the actual usage. > Help would be appreciated. > I'd remove the "setup" keyword from the command. Let me know if I can go ahead with this change. -- Maxim Konovalov _______________________________________________ [email protected] mailing list https://lists.freebsd.org/mailman/listinfo/svn-doc-all To unsubscribe, send any mail to "[email protected]"