[TempNZ]

Hi there.

We've got a firewall at work which we run doom servers behind just fine.

The problem is running the client which uses a random query port to query master server lists.

I had thought using the following rules would let this work, but I can't figure out why not. Can someone please let me know what I am doing wrong.

${fwcmd} add 10250 pass log all from any to any out via ${oif} setup keep-state

fxp0 is our ${oif}

you can see the result of it here

Aug 5 15:20:26 BRFW01 kernel: ipfw: 10250 Accept UDP 210.nn.nn.186:2691 24.10.75.186:32781 out via fxp0
Aug 5 15:20:26 BRFW01 kernel: ipfw: 10250 Accept UDP 210.nn.nn.186:2691 68.113.14.80:33453 out via fxp0
Aug 5 15:20:26 BRFW01 kernel: ipfw: 10250 Accept UDP 210.nn.nn.186:2691 217.234.182.89:35230 out via fxp0
Aug 5 15:20:26 BRFW01 kernel: ipfw: 64000 Deny UDP 69.132.47.91:1576 10.0.1.127:2691 in via fxp0
Aug 5 15:20:26 BRFW01 kernel: ipfw: 64000 Deny UDP 24.10.75.186:32781 10.0.1.127:2691 in via fxp0
Aug 5 15:20:26 BRFW01 kernel: ipfw: 64000 Deny UDP 63.224.23.210:1046 10.0.1.127:2691 in via fxp0

Am I missing something here, I just want to allow all traffic out and let it come back, I thought that's what the stateful firewall did? Or is it because it's coming back to an internal address that it's happening?

[draconius]

I don't use ipfw much for actual firewall (DUMMYNET suppport more) but in IPF, I have to have a 'keep state' line in my rule somewhere so that it keeps state... I don't know if perhaps ipfw has something similar....

[bmw]

Yes, ipfw is stateful and his pass rule contains the keep-state clause. But he needs a "check-state" rule early in the set of rules. That special rule causes the implied stateful rules to be tested when it's encountered.

But I think the problem may be the "setup" flag. That only matches/applies-to TCP streams, not UDP. Try creating two rules: one for TCP with setup and the other for UDP without. (UDP is stateless, there's no handshake as with TCP, so setup will not apply or match.) I can see that rule 10250 is being applied to the UDP packets but I'm thinking that maybe the stateful logic is being fooled.

Note that I am not an expert at ipfw2 (the newer version in later FreeBSD releases) so take my advice with the usual grain of foodstuffs.

Cheers!