Having a problem with 10.5 firewall. I configured it remotely using
ARD (like I've done many times with 10.2, 10.3, 10.4). But after
starting it, all incoming traffic is blocked, and I have to call the
data center and have them stop the firewall to regain access.
I've gone through the rules and don't see a problem (see below). If
I'm having a brain fart and missing something please let me know.
Is the following line really as shown?
add 12311 allow igmp from any to any add 12312 allow tcp from any
to any 3283,5900
It looks like two lines stuck together. And one is for ARD.
Otherwise, anyone else seen this issue?
# This file is reserved for rules automatically generated by the
Server Admin app.
# If you need to add additional rules, put them in /etc/ipfilter/ipfw.conf.
# Generated: 2007-11-07 10:30:45 -0800.
#
add 12300 allow tcp from any to any established
add 12301 allow tcp from any to any out
add 12302 allow tcp from any to any 22
add 12302 allow udp from any to any 22
add 12303 allow udp from any to any out keep-state
add 12304 allow tcp from any to any 53 out keep-state
add 12304 allow udp from any to any 53 out keep-state
add 12305 allow udp from any to any in frag
add 12306 allow tcp from any to any 311
add 12307 allow tcp from any to any 625
add 12308 allow udp from any to any 626
add 12309 allow icmp from any to any icmptypes 8
add 12310 allow icmp from any to any icmptypes 0
add 12311 allow igmp from any to any add 12312 allow tcp from any
to any 3283,5900
add 12312 allow udp from any to any 3283,5900
add 12313 allow tcp from any to any 687
add 12314 allow tcp from any to any 548
add 1000 allow all from any to any via lo0
add 1010 deny log all from any to 127.0.0.0/8
add 1020 deny log ip from 224.0.0.0/4 to any in
add 1030 deny log tcp from any to 224.0.0.0/4 in
# add 65000 deny log tcp from any to any in setup
# add 65001 deny log udp from any to any in
# add 63300 deny log igmp from any to any in
# add 63200 deny log icmp from any to any in icmptypes 0,8
add 65534 deny log ip from any to any
--
Randall Perry
sysTame
Xserve Web Hosting/Co-location/Leasing
QuickTime Streaming
Mac Consulting/Sales
--
Clark Martin
Redwood City, CA, USA
Macintosh / Internet Consulting
"I'm a designated driver on the Information Super Highway"
_______________________________________________
Do not post admin requests to the list. They will be ignored.
Macos-x-server mailing list (email@hidden)
Help/Unsubscribe/Update your Subscription:
http://lists.apple.com/mailman/options/macos-x-server/email@hidden
