On Thu, December 20, 2007 1:39 am, W. D. wrote: I'm no expert on firewalls, so take this with a grain of salt.
>>> # Loopback: >>> # Allow anything on the local loopback: >>> add allow all from any to any via lo0 >>> add deny ip from any to 127.0.0.0/8 >>> add deny ip from 127.0.0.0/8 to any >>Nope. >>> # Allow established connections: >>> add allow tcp from any to any established >>Nope. >>> # Deny fragmented packets: >>> add deny ip from any to any frag Perhaps this is the issue? I would think that if an IP fragment comes in, it's specifically *not* an established TCP connection (yet), so it would be blocked by this rule. No IP fragments means they don't have a chance to be reassembled into an actual packet. All the profiles in rc.firewall specifically allow ip frags, so I'd think they're required. > Could anyone please throw this tired dog a bone? Fetch! :) -- Matt Piechota _______________________________________________ [email protected] mailing list http://lists.freebsd.org/mailman/listinfo/freebsd-security To unsubscribe, send any mail to "[EMAIL PROTECTED]"
