Re: Simple (yet bothersome) configuration

[Phil Dibowitz]

Faulconer, Steven M. wrote:

pass in quick on dmfe0 proto tcp from any to <firewall> port = 80
pass in quick on dmfe0 proto udp from any to <firewall> port = 80
pass out quick on dmfe1 proto tcp from <webserver> to any port = 80
pass out quick on dmfe1 proto udp from <webserver> to any port = 80

block in all
block out all

This won't solve your problem, but you'll have a much more effecient ruleset with this:

----------------------------
pass in quick on dmfe0 proto tcp/udp from any to <firewall> port = 80 keep state

block in all
block out all
----------------------------

Advantages:
- less rules
- more secure, it follows the state
- will allow any related ICMPs such as type 3/4 needed for Path MTU Discovery


--
Phil Dibowitz [EMAIL PROTECTED]
Freeware and Technical Pages Insanity Palace of Metallica
http://home.earthlink.net/~jaymzh666/ http://www.ipom.com/

"They that can give up essential liberty to obtain a little temporary
safety deserve neither liberty nor safety."
- Benjamin Franklin, 1759