Re: svn commit: r49600 - head/en_US.ISO8859-1/books/handbook/firewalls

On 2017-01-03 16:56, Warren Block wrote:
> On Tue, 3 Jan 2017, Maxim Konovalov wrote:
> 
>>>> Hi Warren,
>>>>
>>>> On Fri, 28 Oct 2016, 15:31-0000, Warren Block wrote:
>>>>
>>>> [...]
>>>>>  # Allow outbound NTP
>>>>> -$cmd 00260 allow tcp from any to any 37 out via $pif
>>>>> setup
>>>>> keep-state
>>>>> +$cmd 00260 allow udp from any to any 123 out via
>>>>> $pif setup
>>>>> keep-state
>>>>>
>>>>>  # Allow outbound SSH
>>>>>  $cmd 00280 allow tcp from any to any 22 out via $pif
>>>>> setup
>>>>> keep-state
>>>>>
>>>> Are you sure about this change?  NTP is UDP based protocol.  In the
>>>> same time "setup" is TCP only feature (why ipfw(8) allows it to use in
>>>> conjunction with the UDP proto is a different story)
>>>>
>>>> I think the comment is what should be fixed here.
>>>
>>> https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=213365 suggested
>>> merely
>>> changing this to UDP 123.  I don't use IPFW, so can't verify the
>>> actual usage.
>>> Help would be appreciated.
>>>
>> I'd remove the "setup" keyword from the command.  Let me know if I can
>> go ahead with this change.
> 
> It's okay with me.  Er, "Approved".  It would be really nice if you
> could test and verify it, but not required.
> 
> Thanks!
> 

It is indeed not required. The 'setup' keyword looks for the 'syn' flag
on the TCP packet, saying this is the initiation of a new connection.
Does not apply at all to UDP.

-- 
Allan Jude

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2.0.22 (MingW32)

iQIcBAEBAgAGBQJYbUysAAoJEBmVNT4SmAt+ApUQALrZ3T0gzrzrjmQAcB/NbthT
IyuxbaXY8piPb5dhzsppB3Cy6uwMwD/ldb6JVMu18mkdbcnjx+LX7z3//UEDC2xk
DIvs5PN8Y59BS7r5ZdliN6FkrEtSTQlax9Gt5DXktufIVZ6hOXMvzzEE0Aycm603
p+HCjgNHD2xFMASaa76MIuoqYD9HTxKD4JMULf1/CVhPK2eiRXSkgwiFQiCdk9Z1
w2yrAnUnmy6d/o9djMUQB7U1cVIs0dJ/num5LV/e8/45MFRshMPh3ClnHNK3D66I
4jpaMe4L2JZ4doQvDdFKVhruXFAgFonPfRB94EfvTP/EmWDPQgmE+MW4eByqBjaA
AyUt+buqWYKKd+nDGNv2qL+rchqgZaZAIAmbHPMChjUAylpnvbjYvDbG6n5TudKo
b0D5T8MrRZyY62jHMPyt1GQDMZh7Yg5K2+oRZtddHo8Hp+BSLe4fqi8EBwI9KF7P
Uv++wCGuLI52ramkvZifAn0BwBT1DokwdIMY/sv1xL0lm6Kui0wlr2Uv64VUgO3F
myKmsFsgxafbGGFxYZOwUK+CMt/hStALdkELXc2Xcc5iIzeIj4lPElbxQiNyroce
dxcgZsTRWFp4Y4lGMOcVRJV5eANdQrhBNRMGPocU3McpB6dos1BieGg6Nkl7uqGk
tjs28A9a1Jh2xSMEDGpw
=12E9
-----END PGP SIGNATURE-----