Help with IP Filter 4.1.8

[Giorgos Keramidas]

On 2006-02-26 20:15, Roman Serbski <mefystofel at gmail.com> wrote:
> Hi all,
>
> I am having a problem with ipf after recent upgrade to 6.1-PRERELEASE.
> Any help would be greatly appreciated.
>
> ipf: IP Filter: v4.1.8 (416)
> Kernel: IP Filter: v4.1.8
> Running: yes
> Log Flags: 0 = none set
> Default: pass all, Logging: available
> Active list: 0
> Feature mask: 0xa
>
> I am trying to allow outgoing dns requests from my server to DNS
> server of ISP. Here is my ruleset:
>
> # ipfstat -oh
> 0 pass out quick on lo0 from any to any
> 0 pass out quick on xl0 proto tcp from any to any port = domain flags S/FSRPAU keep state
> 1 pass out quick on xl0 proto udp from any to any port = domain keep state
> 0 block out log quick on xl0 all

This part seems ok.  I'd probably try without the ``flags S/FSRPAU''
part, but that's relatively harmless.

> # ipfstat -ih
> 0 pass in quick on lo0 from any to any
> 0 block in quick on xl0 all

This part seems a bit paranoid, but relatively ok too.

> I tried `host www.google.com` and the connection was timed out,
> although there was a hit on a rule allowing 53/udp.

> The interesting thing is that there is another server running
> 5.3-STABLE with ipf v3.4.35 (336) and it has the same ruleset and
> everything is working just fine.

When you're having problems with IP Filter rules, it's always a good
idea to `log' the blocking rules.  Can you try the following two things?

    a) Remove the `flags' part of the stateful rule.

    b) Add a `log' keyword to the input blocking rule.

The rulesets for these two cases would be:

    # Ruleset 1.
    pass out quick on lo0 from any to any
    pass out quick on xl0 proto tcp from any to any port = domain keep state
    pass out quick on xl0 proto udp from any to any port = domain keep state
    block out log quick on xl0 all
    pass in quick on lo0 from any to any
    block in quick on xl0 all

    # Ruleset 2.
    pass out quick on lo0 from any to any
    pass out quick on xl0 proto tcp from any to any port = domain keep state
    pass out quick on xl0 proto udp from any to any port = domain keep state
    block out log quick on xl0 all
    pass in quick on lo0 from any to any
    block in log quick on xl0 all

When you install the logging final rule, please check your system logs
for blocked packets.  Then you'll have an idea why something is blocked,
what was blocked, etc.  Post the ipfilter log messages as a followup to
this thread, and we'll try to track down the problem the current ruleset
has.

- Giorgos