On 17.11.2007, at 15:54, Chris Pepper wrote:

>> All this is an improvement, but IMO it's still not actually good.
>> The big
>> improvement one is configd - I gave up on writing a stateful ipfw
>> filter
>> for DHCP, because the request goes out to the broadcast, but the
>> response
>> is from a non-broadcast source. Application awareness is a nice
>> one here
>
> I just realized I had blocked DHCP; this is letting it work, but I
> haven't
> done much testing yet:
>
> # Allow DHCP responses (DHCP broadcasts, which seems to defeat
> # keep-state).
> add 800 allow udp from any to any src-port 67 dst-port 68 in

Maybe you don't want to allow everyone to play DHCP Server for your box.

# if you know all your dhcp servers, take a list of them
DHCP=(192.168.0.1 10.0.0.1)
# DHCP ruleset
i=1
while [ $i -le ${#DHCP} ] ; do
/sbin/ipfw add 0200$i allow log udp from me 68 to 255.255.255.255 67 out
/sbin/ipfw add 0201$i allow log udp from $DHCP[$i] 67 to any 68 in
i=$[$i+1]
done

Greets,
Sandor Szücs
--

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.5 (Darwin)

iD8DBQFHQYipZq/O2MMUFDsRAm3cAJ45ScvkDJb0n8lLJZpRVFlnhSfOjACgmdcA
FCEdDdkurK1GQtS1nupTOZg=
=Ynft
-----END PGP SIGNATURE-----

[ reply ]