From owner-FreeBSD-net-jp@jp.freebsd.org  Tue May 26 23:32:22 1998
Received: (from daemon@localhost)
	by jaz.jp.freebsd.org (8.8.8+3.0Wbeta13/8.7.3) id XAA01537;
	Tue, 26 May 1998 23:32:22 +0900 (JST)
	(envelope-from owner-FreeBSD-net-jp@jp.FreeBSD.org)
Received: from smtp.dtinet.or.jp (smtp1.dti.ne.jp [202.216.224.185])
	by jaz.jp.freebsd.org (8.8.8+3.0Wbeta13/8.7.3) with ESMTP id XAA01532;
	Tue, 26 May 1998 23:32:20 +0900 (JST)
	(envelope-from morimo@remus.dti.ne.jp)
Received: from localhost (INS54.himeji.dti.ne.jp [210.159.140.54]) by smtp.dtinet.or.jp (8.8.4+2.7Wbeta4/3.5Wpl2) with ESMTP id XAA15016; Tue, 26 May 1998 23:32:18 +0900 (JST)
Message-Id: <199805261432.XAA15016@smtp.dtinet.or.jp>
To: FreeBSD-net-jp@jp.freebsd.org
Cc: QandA@jp.FreeBSD.ORG
In-Reply-To: Your message of "Tue, 26 May 1998 07:35:30 JST".
	<199805252235.HAA28334@nike.it.f.rd.honda.co.jp>
From: morimo@remus.dti.ne.jp (YOSHIHIRO MORIMO)
X-Mailer: mnews [version 1.21] 1997-12/23(Tue)
Date: Tue, 26 May 1998 23:31:55 +0900
X-Dispatcher: imput version 971024
Mime-Version: 1.0
Content-Type: Text/plain; charset=iso-2022-jp
Lines: 105
Reply-To: FreeBSD-net-jp@jp.freebsd.org
Precedence: list
X-Distribute: distribute [version 2.1 (Alpha) patchlevel=24]
X-Sequence: FreeBSD-net-jp 691
Subject: [FreeBSD-net-jp 691] Re: ppp filter setting 
Errors-To: owner-FreeBSD-net-jp@jp.freebsd.org
Sender: owner-FreeBSD-net-jp@jp.freebsd.org

<199805252235.HAA28334@nike.it.f.rd.honda.co.jp>$B$N5-;v$K$*$$$F(B
JST$B;~4V(B1998$BG/(B05$B7n(B26$BF|(B($B2P(B)07$B;~(B35$BJ,(B30$BIC:"!"(Bmoo@f.rd.honda.co.jp$B$5$s$O(B
$B=q$-$^$7$?!#(B

$B?9K\$G$9!%$"$j$,$H$&$4$6$$$^$7$?!%(BQandA $B$K(B cc: $B$7$^$9!%(B

  | $B?9K\$5$s(B> $BF0$/$N$G$9$,!$0J2<$N4D6-!$@_Dj$G(B cvsup$B!$(Bntpdate $B$,F0$$$F$/$l$^$;$s!%(B
  | 
  | $B?9K\$5$s(B> # ntp
  | $B?9K\$5$s(B>         set ifilter 12 permit tcp src eq 123
  | $B?9K\$5$s(B>         set ofilter 12 permit tcp dst eq 123
  | 
  | udp $B$b3+$1$J$$$H$$$1$J$$$N$G$O(B? 

udp $B$bDI2C$7$F$&$^$/$$$-$^$7$?!%(B

  | $B?9K\$5$s(B> # cvsup
  | $B?9K\$5$s(B>         set ifilter 15 permit tcp src eq 5999
  | $B?9K\$5$s(B>         set ofilter 15 permit tcp src eq 5999
  | 
  | set ifilter 15 permit tcp src eq 5999 estab
  | set ofilter 15 permit tcp dst eq 5999

$B$&!D=$@58e$&$^$/$$$-$^$7$?!%$?$@$7!$(Bcvsup $B$N<B9T;~$K(B "-P m" option
$B$rIU$1$m$H$$$o$l$^$9!%$3$N%*%W%7%g%s$rDI2C$9$k;v$G(B cvsup $B$,F0$/$h$&(B
$B$K$J$j$^$9!%0J2<(B QandA $B$K$^$H$a$^$7$?!%(B

Q. ppp $B$G(B ntpdate $B$H(B cvsup $B$,F0$/(B filter $B$N@_DjJ}K!$r65$($F$/$@$5$$!%(B
A. ntpdate $B$O(B protocol $B$H$7$F(B tcp$B!$(Budp $B$NN>J}$,;H$($k$h$&$K$9$kI,MW(B
$B$,$"$j$^$9!%(Bcvsup $B$O(B port $B$H$7$F(B 5999 $B$r;H$$$^$9!%$^$?!$(Bcvsup $B$N<B9T(B
$B;~$K(B "-P m" $B%*%W%7%g%s$rIU$1$kI,MW$,$"$j$^$9!%0J2<$K(B filter $B$N(Bsample
$B$rE:IU$7$^$9!%(B

# dialing trigger
	set dfilter 0 deny icmp
# -- no smtp dialing
	set dfilter 1 deny tcp src eq 25
	set dfilter 2 deny tcp dst eq 25
#-- no uucp dialing
	set dfilter 3 deny tcp src eq 117
	set dfilter 4 deny tcp dst eq 117
	set dfilter 5 deny tcp src eq 540
	set dfilter 6 deny tcp dst eq 540
	set dfilter 7 deny tcp src eq 541
	set dfilter 8 deny tcp dst eq 541
# -- but all
	set dfilter 9 permit 0/0 0/0
# a filter
	set afilter 0 deny icmp
# -- dns/53
	set afilter 1 deny udp src eq 53
	set afilter 2 deny udp dst eq 53
	set afilter 3 deny udp src eq 520
	set afilter 4 deny udp dst eq 520
	set afilter 5 permit 0/0 0/0
# i/o filter
# auth (ident)
	set ifilter 0 permit tcp dst eq 113
	set ofilter 0 permit tcp src eq 113
# telnet
	set ifilter 1 permit tcp src eq 23 estab
	set ofilter 1 permit tcp dst eq 23
# http
	set ifilter 2 permit tcp src eq 80
	set ofilter 2 permit tcp dst eq 80
# ftp
	set ifilter 3 permit tcp src eq 21 estab
	set ofilter 3 permit tcp dst eq 21
# ftp-data
	set ifilter 4 permit tcp src eq 20 dst gt 1023
	set ofilter 4 permit tcp dst eq 20
# dns
	set ifilter 5 permit udp src eq 53
	set ofilter 5 permit udp dst eq 53
# smtp
	set ifilter 6 permit tcp src eq 25 estab
	set ofilter 6 permit tcp dst eq 25
# icmp
	set ifilter 7 permit icmp
	set ofilter 7 permit icmp
# other
	set ifilter 8 permit udp dst gt 33433
	set ofilter 8 permit udp dst gt 33433
# pop
	set ifilter 10 permit tcp src eq 110 estab
	set ofilter 10 permit tcp dst eq 110
# nntp
	set ifilter 11 permit tcp src eq 119 estab
	set ofilter 11 permit tcp dst eq 119
# ntp
	set ifilter 12 permit tcp src eq 123
	set ofilter 12 permit tcp dst eq 123
	set ifilter 13 permit udp src eq 123
	set ofilter 13 permit udp dst eq 123
# proxy 
	set ifilter 14 permit tcp src eq 8080
	set ofilter 14 permit tcp dst eq 8080 
# rc5des
	set ifilter 15 permit tcp src eq 2064
	set ofilter 15 permit tcp dst eq 2064
# cvsup
	set ifilter 16 permit tcp src eq 5999
	set ofilter 16 permit tcp dst eq 5999
--
MORIMOTO YOSHIHIRO ( $B?9K\(B $BK'9((B ) "http://www.remus.dti.ne.jp/~morimo/"
