Having a problem with 10.5 firewall. I configured it remotely using
ARD (like I've done many times with 10.2, 10.3, 10.4). But after
starting it, all incoming traffic is blocked, and I have to call the
data center and have them stop the firewall to regain access.
I've gone through the rules and don't see a problem (see below). If
I'm having a brain fart and missing something please let me know.
Is the following line really as shown?
add 12311 allow igmp from any to any add 12312 allow tcp from any to
any 3283,5900
It looks like two lines stuck together. And one is for ARD.
That must've happened when I pasted the rules into the email -- the rule
file shows them as 2 separate lines.
So, correct rules are:
# This file is reserved for rules automatically generated by the Server
Admin app.
# If you need to add additional rules, put them in /etc/ipfilter/ipfw.conf.
# Generated: 2007-11-07 10:30:45 -0800.
#
add 12300 allow tcp from any to any established
add 12301 allow tcp from any to any out
add 12302 allow tcp from any to any 22
add 12302 allow udp from any to any 22
add 12303 allow udp from any to any out keep-state
add 12304 allow tcp from any to any 53 out keep-state
add 12304 allow udp from any to any 53 out keep-state
add 12305 allow udp from any to any in frag
add 12306 allow tcp from any to any 311
add 12307 allow tcp from any to any 625
add 12308 allow udp from any to any 626
add 12309 allow icmp from any to any icmptypes 8
add 12310 allow icmp from any to any icmptypes 0
add 12311 allow igmp from any to any
add 12312 allow tcp from any to any 3283,5900
add 12312 allow udp from any to any 3283,5900
add 12313 allow tcp from any to any 687
add 12314 allow tcp from any to any 548
add 1000 allow all from any to any via lo0
add 1010 deny log all from any to 127.0.0.0/8
add 1020 deny log ip from 224.0.0.0/4 to any in
add 1030 deny log tcp from any to 224.0.0.0/4 in
# add 65000 deny log tcp from any to any in setup
# add 65001 deny log udp from any to any in
# add 63300 deny log igmp from any to any in
# add 63200 deny log icmp from any to any in icmptypes 0,8
add 65534 deny log ip from any to any
--
Randall Perry
sysTame
Xserve Web Hosting/Co-location/Leasing
QuickTime Streaming
Mac Consulting/Sales
