I meant
pass out quick on rl0 proto tcp from any to any port = 53 keep state frags
pass out quick on rl0 proto udp from any to any port = 53 keep state frags
I did it in kind of a hurry. On Jan 17, 2005, at 3:33 PM, Alvaro J. Gurdián wrote:
If you compiled you kernel, and added options IPFILTER_DEFAULT_BLOCK, then you need to explicitly allow each service to leave the interface, as well as come in thru the interface. For example add:
pass in quick proto tcp from any to any port = 53 keep state keep keep state frags
pass in quick proto udp from any to any port = 53 keep state keep frags
this allows the the computer to attempt to contact the DNS server upstream from it.
Hope this helps, Alvaro Gurdián Jr.
On Jan 16, 2005, at 10:35 AM, Kövesdán Gábor wrote:
Hi,
I have some trouble with the ipf configuration. I made the following ruleset:
pass in quick on rl0 proto udp from any to any port = 68 keep state
pass in quick proto udp from any to any port = 53 keep state keep frags
pass in quick on rl0 proto tcp/udp from any to any port = 42 keep state keep
frags
pass in quick on rl0 proto tcp from any to any port = 22 flags S keep state
pass in quick on rl0 proto tcp from any to any port = 25 keep state
pass in quick on rl0 proto tcp from any to any port = 21 keep state
pass in quick on rl0 proto tcp from any to any port = 20 keep state
pass in quick on rl0 proto tcp from any to any port = 80 keep state
block return-rst in log quick on rl0 proto tcp from any to any
block return-icmp-as-dest(port-unr) in log quick on rl0 proto udp from any
to any
block in quick on rl0 all
pass in quick on lo0 all pass out quick on lo0 all
Everything seems okay, but the named. Neiher the ISP's nameserver (set by
the dhcp) nor the local nameserver works. BIND 9 wrote this to
/var/log/messages:
Jan 16 13:59:35 server named[1028]: starting BIND 9.3.0 -u named -t
/usr/local/named -c /etc/named.conf
Jan 16 13:59:35 server named[1028]: could not listen on UDP socket: address
in use
Jan 16 13:59:35 server named[1028]: creating IPv4 interface re0 failed;
interface ignored
Jan 16 13:59:35 server named[1028]: could not listen on UDP socket: address
in use
Jan 16 13:59:35 server named[1028]: creating IPv4 interface lo0 failed;
interface ignored
Jan 16 13:59:35 server named[1028]: not listening on any interfaces
Jan 16 13:59:35 server named[1028]: /etc/named.conf:14: couldn't add command
channel 127.0.0.1#953: address in
use
Jan 16 13:59:35 server named[1028]: could not listen on UDP socket:
permission denied
Jan 16 13:59:35 server named[1028]: creating IPv4 interface re0 failed;
interface ignored
Jan 16 13:59:35 server named[1028]: could not listen on UDP socket:
permission denied
Jan 16 13:59:35 server named[1028]: creating IPv4 interface lo0 failed;
interface ignored
The rndc doesn't matter, I'm not going to use it, but the neither named can
listen on the network and the loopback interface. Could You suggest me any
solution for this trouble? Btw, this machine is going to be a web, dns,
mail, etc. server and is being tested on an ordinary cable connection,
that's why I'm using dhcp.
Best regards,
Gábor Kövesdán
_______________________________________________
freebsd-questions@freebsd.org mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-questions
To unsubscribe, send any mail to "[EMAIL PROTECTED]"
_______________________________________________
freebsd-questions@freebsd.org mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-questions
To unsubscribe, send any mail to "[EMAIL PROTECTED]"
_______________________________________________ freebsd-questions@freebsd.org mailing list http://lists.freebsd.org/mailman/listinfo/freebsd-questions To unsubscribe, send any mail to "[EMAIL PROTECTED]"
