Minor rpc question ....
William A. Mahaffey III
wam at hiwaay.net
Sun Nov 2 23:00:09 UTC 2014
On 11/02/14 16:43, William A. Mahaffey III wrote:
> On 11/02/14 11:12, Ian Smith wrote:
>> William, I've just seen your response at
>> http://lists.freebsd.org/pipermail/freebsd-questions/2014-November/262026.html
>>
>> but as I take questions@ as a digest, I won't get it here till tomorrow
>> .. I should have asked you to cc me.
>>
>> So this is a brief hatchet job:
>>
>> > 02500 18777 23476935 allow tcp from 192.168.0.0/16 to me
>> > 65000 1795 424041 count ip from any to any
>> > 65100 1371 269257 deny { tcp or udp } from any to any
>> dst-port 111,137,138,513 in
>>
>> > w/ port 513 obviously being denied. However, I don't know where that
>> > is happening :-/ & I thought rule 02500 would let all local traffic
>> > through ....
>>
>> /etc/rc.firewall 'workstation' ruleset allows you to enable inbound
>> access to services, like rwhod. see /etc/defaults/rc.conf for details
>> of rc.conf variables, and rc.firewall for how they're invoked.
>>
>> Rule 2500 only allows tcp, rwho is udp - but 2500 is a bit sweeping
>> anyway, perhaps best to enable specific services, even internally?
>>
>> Ah, yes - I see firewall_myservices and firewall_allowservices are only
>> for TCP services. That's a strange omission, if I'm reading it right,
>> especially re rpc.
>>
>> Rather than fixing this properly now for UDP services, I'd just add into
>> /etc/rc.firewall after what's now your 2500 or at any rate before 65000:
>>
>> ${fwcmd} allow udp from ${mynetwork} 513 to me 513
>>
>> You're already enabling udp services outbound, statefully, which is why
>> you can query other hosts. Now they'll be able to reach you too :)
>>
>> 'service ipfw restart' and you should be good to go. You could remove
>> 513 from firewall_nologports - but now it'll already be passed by then.
>>
>> g'night, Ian
>>
>
> Well, I put that rule in & opened logging for that port & now I get
> ruptime info from other boxen, however, I also get log traffic about
> denied port 513 traffic:
>
> [root at kabini1, /etc, 4:34:01pm] 368 % service ipfw restart
> net.inet.ip.fw.enable: 1 -> 0
> net.inet6.ip6.fw.enable: 1 -> 0
> Flushed all rules.
> 00100 allow ip from any to any via lo0
> 00200 deny ip from any to 127.0.0.0/8
> 00300 deny ip from 127.0.0.0/8 to any
> 00400 deny ip from any to ::1
> 00500 deny ip from ::1 to any
> 00600 allow ipv6-icmp from :: to ff02::/16
> 00700 allow ipv6-icmp from fe80::/10 to fe80::/10
> 00800 allow ipv6-icmp from fe80::/10 to ff02::/16
> 00900 allow ipv6-icmp from any to any ip6 icmp6types 1
> 01000 allow ipv6-icmp from any to any ip6 icmp6types 2,135,136
> 01100 check-state
> 01200 allow tcp from me to any established
> 01300 allow tcp from me to any setup keep-state
> 01400 allow udp from me to any keep-state
> 01500 allow icmp from me to any keep-state
> 01600 allow ipv6-icmp from me to any keep-state
> 01700 allow udp from 0.0.0.0 68 to 255.255.255.255 dst-port 67 out
> 01800 allow udp from any 67 to me dst-port 68 in
> 01900 allow udp from any 67 to 255.255.255.255 dst-port 68 in
> 02000 allow udp from fe80::/10 to me dst-port 546 in
> 02100 allow icmp from any to any icmptypes 8
> 02200 allow ipv6-icmp from any to any ip6 icmp6types 128,129
> 02300 allow icmp from any to any icmptypes 3,4,11
> 02400 allow ipv6-icmp from any to any ip6 icmp6types 3
> 02500 allow tcp from 192.168.0.0/16 to me
> 02600 allow udp from 192.168.0.0/24 513 to me dst-port 513
> 65000 count ip from any to any
> 65100 deny { tcp or udp } from any to any dst-port 111,137,138 in
> 65200 deny { tcp or udp } from 192.168.0.0/16 to me
> 65300 deny ip from any to 255.255.255.255
> 65400 deny ip from any to 224.0.0.0/24 in
> 65500 deny udp from any to any dst-port 520 in
> 65500 deny tcp from any 80,443 to any dst-port 1024-65535 in
> 65500 deny log logamount 5000 ip from any to any
> Firewall rules loaded.
> [root at kabini1, /etc, 4:34:03pm] 369 %
>
>
> [root at kabini1, /etc, 4:37:13pm] 337 % ( tail -20 /var/log/security ;
> date )
> Oct 30 11:00:00 kabini1 newsyslog[9861]: logfile turned over due to
> size>100K
> Oct 30 11:00:30 kabini1 kernel: ipfw: 65500 Deny UDP
> 92.108.103.99:58507 192.168.0.27:63167 in via re0
> Oct 30 11:00:49 kabini1 kernel: ipfw: 65500 Deny P:2 192.168.0.27
> 224.0.0.22 out via re0
> Oct 30 11:00:52 kabini1 kernel: ipfw: 65500 Deny P:2 192.168.0.27
> 224.0.0.22 out via re0
> Oct 30 11:01:16 kabini1 kernel: ipfw: 65500 Deny UDP 126.43.5.41:6881
> 192.168.0.27:63167 in via re0
> Oct 30 11:02:24 kabini1 kernel: ipfw: 65500 Deny P:2 192.168.0.27
> 224.0.0.22 out via re0
> Oct 30 11:02:24 kabini1 kernel: ipfw: 65500 Deny P:2 192.168.0.27
> 224.0.0.22 out via re0
> Oct 31 10:16:03 kabini1 kernel: ipfw: 65500 Deny UDP 216.180.99.2:53
> 192.168.0.27:28277 in via re0
> Nov 2 16:31:12 kabini1 kernel: ipfw: 65500 Deny UDP 192.168.0.4:513
> 192.168.0.255:513 in via re0
> Nov 2 16:32:25 kabini1 kernel: ipfw: 65500 Deny UDP 192.168.0.9:513
> 192.168.0.255:513 in via re0
> Nov 2 16:32:28 kabini1 kernel: ipfw: 65500 Deny UDP 192.168.0.7:513
> 192.168.0.255:513 in via re0
> Nov 2 16:34:12 kabini1 kernel: ipfw: 65500 Deny UDP 192.168.0.4:513
> 192.168.0.255:513 in via re0
> Nov 2 16:35:25 kabini1 kernel: ipfw: 65500 Deny UDP 192.168.0.9:513
> 192.168.0.255:513 in via re0
> Nov 2 16:35:28 kabini1 kernel: ipfw: 65500 Deny UDP 192.168.0.7:513
> 192.168.0.255:513 in via re0
> Nov 2 16:37:12 kabini1 kernel: ipfw: 65500 Deny UDP 192.168.0.4:513
> 192.168.0.255:513 in via re0
> Nov 2 16:38:25 kabini1 kernel: ipfw: 65500 Deny UDP 192.168.0.9:513
> 192.168.0.255:513 in via re0
> Sun Nov 2 16:38:26 CST 2014
> [root at kabini1, /etc, 4:38:26pm] 337 %
>
> [wam at kabini1, ~, 9:03:43am] 330 % ruptime -a
> Q6600 up 299+08:00, 6 users, load 0.03,
> 0.04, 0.05
> athloncube up 45+21:08, 4 users, load 0.00,
> 0.01, 0.05
> kabini1 up 23:01, 1 user, load 0.35,
> 0.19, 0.10
> opty165a up 299+08:00, 4 users, load 0.00,
> 0.00, 0.00
> [wam at kabini1, ~, 4:34:49pm] 330 % ruptime
> Q6600 down 0:13
> athloncube down 0:14
> kabini1 up 23:07, 0 users, load 0.21,
> 0.26, 0.16
> opty165a down 0:13
> [wam at kabini1, ~, 4:41:57pm] 331 % ruptime -a
> Q6600 down 0:13
> athloncube down 0:14
> kabini1 up 23:07, 1 user, load 0.21,
> 0.26, 0.16
> opty165a down 0:13
> [wam at kabini1, ~, 4:42:03pm] 332 %
>
>
> err, well, I had it for a second :-/ ....
>
Sooooo tacky to self reply, but it seems warranted here. Using the ipfw
command:
${fwcmd} add pass udp from 192.168.0.0/24 513 to 192.168.0.0/24 513
gets ruptime traffic in/out *and* cuts out extraneous logging .... Just
for posterity :-) ....
--
William A. Mahaffey III
----------------------------------------------------------------------
"The M1 Garand is without doubt the finest implement of war
ever devised by man."
-- Gen. George S. Patton Jr.
More information about the freebsd-questions
mailing list