Re: firewall problem

Mirko Manea (mami@juliet.sci.univr.it)
Thu, 24 Oct 1996 13:44:38 MET


Hi!

> > /sbin/ipfwadm -O -a reject -W ppp0 -P tcp -S 157.27.10.0/24 \
> > -D 0.0.0.0/0 21 23 \
> > 70 80 194 1000:65535
> > /sbin/ipfwadm -O -a reject -W ppp0 -P tcp -S 157.27.10.0/24 \
> > -D 0.0.0.0/0 21 23 \
> > 70 80 194 1000:65535
>
> This is your problem ----------------------------------------^^^^^^^^^^
> What this does is say that all packets originating on the 157.27.10.0/24
> network will be blocked if their source ports are 21, 23, 70, 80, 194 and
> 1000 through 65535. What happens when someone telnets from the outside to
> the inside? Your inside machine hears a telnet request, and when it goes
> to reply (to complete the three-way TCP handshake and establish a
> dialogue), it's reply packet gets blocked. The packet is blocked because
> you've blocked all ports between 1000 and 65535, inclusive. These are the
> ports that most of your replies will originate from.

What ports should I enable to get the things work ?

> (just out of curiosity, how come you have the rule listed twice?)

I mistake! I should write 'udp', not 'tcp' (or maybe 'all').