I would suggest
ipfw add 4100 allow udp from me to any 53 keep-state
ipfw add 4200 allow udp from any to me 53 keep-state
which allows either side to initiate the connection. You will also need TCP
versions of these rules (DNS uses both).
If you use ipfw2, which is the default in 5.x, you can combine them into the
same rule like so:
ipfw add 4100 allow ( tcp or udp ) from me to any 53 keep-state
ipfw add 4200 allow ( tcp or udp ) from any to me 53 keep-state
What does /var/log/security show?
----- Original Message -----
From: "Gregory Edigarov" <[EMAIL PROTECTED]>
Subject: ipfw keep-state (ASAP anwser need)
> Hello,
>
> The folowing is a fragment of my rc.firewall which must allow all
> traffic in and out of my named.
>
> ----
> ipfw add 4100 allow udp from me to any 53 keep-state
> ipfw add 4200 allow udp from any to me 53
> ipfw add 4300 allow udp from me 53 to any
> ---
> This is a fragment from my kernel configuration:
> ---
> options IPFIREWALL #firewall
> options IPFIREWALL_VERBOSE #enable logging to
> syslogd(8)
> options IPFIREWALL_FORWARD #enable transparent proxy
> support
> options IPFIREWALL_VERBOSE_LIMIT=100 #limit verbosity
> options IPDIVERT #divert sockets
> options IPSTEALTH
> options ICMP_BANDLIM
> options DUMMYNET
> options BRIDGE
> options IPFW2
> ---
> It doesn't work. What am I missing?
>
> --
> With best regards,
> Gregory Edigarov
> --------------------------------------------------------------------------
----
> profi.kharkov.ua Systems
Administrator
> --------------------------------------------------------------------------
----
> _______________________________________________
> [EMAIL PROTECTED] mailing list
> http://lists.freebsd.org/mailman/listinfo/freebsd-questions
> To unsubscribe, send any mail to
"[EMAIL PROTECTED]"
>
_______________________________________________
[EMAIL PROTECTED] mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-questions
To unsubscribe, send any mail to "[EMAIL PROTECTED]"
