firewall problem

[WarrenB]

Hello,

I am trying to open port 8125 for outgoing traffic but nothing I seem to do is working? I am using "ipfw add allow udp from any to x.x.x.x dst-port 8125 vi any" and few combination of that line. No matter what combination of the above line I try I am not able to send out on that port. I have already checked for any deny rules and there are none that would prevent me from sending out to a specific udp port. Is there any other way to open/enable ports in freebsd??

Thanks
Warren

[J65nko]

Usually TCP/UDP ports are not blocked by default. Unless you run a packet filter and use a default blocking rule. In that case you will have to open an port with an packet filter rule that allows traffic with that destination port out.

If you change the port number to 53 you should be able to use DNS queries like:

 $ dig www.freebsd.org

Does that work?

My ipfw skills are very rusty. But with "pf" you will have to do something like this

ext_if = re0
block log all
pass out quick on $ext_if inet udp  from any to any port 8125 keep state

Be warned that this blocks everything including incoming ssh, so you should not use this if you are dealing with a remote client

The nice thing with pf is that you can run tcpdump on the /dev/pflog0 device and see the packets which are being blocked.
With the above sample pf.conf udp DNS queries with destination port 53 are being blocked and shown as follows:

$ sudo tcpdump -tttnei pflog0
Nov 12 22:29:29.283970 rule 0/(match) block out on re0: 192.168.222.20.46971 > 192.168.222.10.53: 8001+[|domain]
Nov 12 22:29:34.292638 rule 0/(match) block out on re0: 192.168.222.20.46971 > 192.168.222.10.53: 8001+[|domain]
Nov 12 22:29:39.302588 rule 0/(match) block out on re0: 192.168.222.20.46971 > 192.168.222.10.53: 8001+[|domain]

This is a nice way to debug firewall rules.