> It's a question of letting DNS traffic _in_ to your nameserver: > > pass in on $ext_if inet proto { tcp, udp } \ > from any to ($ext_if) port 53 > > ^^^ that lets the traffic in.... > > pass out on $ext_if inet proto { tcp, udp } \ > from ($ext_if) port 53 to any > > ^^^ and that lets it back out. > > If you add the "query-source address * port 53;" to your named.conf > "options" section, that'll suffice; additionally, since your DNS query > source port is then predictable, you can drop it from the DNS and NTP > rule.
Hello again, Jan! Well, I tried applying what you said now as well as last time you said it -- but the problem is still there. Unless I uncomment the default deny policy nothing seems to work. The problem must lie elsewhere in my ruleset: int_if="ep0" ext_if="lnc0" # *** Options # set block-policy drop # *** Scrub incoming packets # scrub in all # *** NAT # nat on $ext_if from $int_if:network to any -> ($ext_if) rdr on $int_if proto tcp from any to any \ port 21 -> 127.0.0.1 port 8021 # *** Default deny policy # # block drop log all # *** Pass loopback traffic # pass quick on { lo0 $int_if } # *** Outgoing # pass out on $ext_if inet proto { tcp, udp, icmp } \ from ($ext_if) to any keep state # *** DNS # pass in on $ext_if inet proto { tcp, udp } \ from any to ($ext_if) port 53 pass out on $ext_if inet proto { tcp, udp } \ from ($ext_if) port 53 to any # *** NTP # pass out on $ext_if inet proto udp \ from ($ext_if) to any port { 53, 123 } keep state # *** SSH, HTTP and Ident # pass in on $ext_if inet proto tcp \ from any to ($ext_if) port { 22, 80, 113 } flags S/SA keep state # *** Active FTP # pass in on $ext_if inet proto tcp \ from port 20 to ($ext_if) user proxy flags S/SA keep state # *** Private FTP # pass in on $ext_if proto tcp \ from any to any port 31337 keep state pass in on $ext_if proto tcp \ from any to any port 53333:55555 -- Fafa Hafiz Krantz Research Designer @ http://www.home.no/barbershop Enlightened @ http://www.home.no/barbershop/smart/sharon.pdf -- ___________________________________________________________ Sign-up for Ads Free at Mail.com http://promo.mail.com/adsfreejump.htm _______________________________________________ freebsd-questions@freebsd.org mailing list http://lists.freebsd.org/mailman/listinfo/freebsd-questions To unsubscribe, send any mail to "[EMAIL PROTECTED]"