svn commit: r49600 - head/en_US.ISO8859-1/books/handbook/firewalls

[Warren Block]

On Tue, 3 Jan 2017, Maxim Konovalov wrote:

>>> Hi Warren,
>>>
>>> On Fri, 28 Oct 2016, 15:31-0000, Warren Block wrote:
>>>
>>> [...]
>>>>  # Allow outbound NTP
>>>> -$cmd 00260 allow tcp from any to any 37 out via $pif setup
>>>> keep-state
>>>> +$cmd 00260 allow udp from any to any 123 out via $pif setup
>>>> keep-state
>>>>
>>>>  # Allow outbound SSH
>>>>  $cmd 00280 allow tcp from any to any 22 out via $pif setup
>>>> keep-state
>>>>
>>> Are you sure about this change?  NTP is UDP based protocol.  In the
>>> same time "setup" is TCP only feature (why ipfw(8) allows it to use in
>>> conjunction with the UDP proto is a different story)
>>>
>>> I think the comment is what should be fixed here.
>>
>> https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=213365 suggested merely
>> changing this to UDP 123.  I don't use IPFW, so can't verify the actual usage.
>> Help would be appreciated.
>>
> I'd remove the "setup" keyword from the command.  Let me know if I can
> go ahead with this change.

It's okay with me.  Er, "Approved".  It would be really nice if you 
could test and verify it, but not required.

Thanks!