[FUG-BR] Regras IPFW bloqueia o portupgrade

[Cristina Fernandes Silva]

Pessoal,

Alguem sabe o que esta acontecendo com essas regras que esta bloqueando
somente ALGUMAS atualizações do portupgrade já liberei as portas 20 e 21, 80
e só atualiza quando eu limpo a regras "ipfw -f flush".

#!/bin/sh

fwcmd="/sbin/ipfw -q"

oif="fxp0"
onet="189.XX.XX.XX"
omask="255.255.255.192"
oip="189.XX.XX.XX"
CAIS="200.144.121.33"

${fwcmd} -f flush

${fwcmd} add check-state

# Libera acesso via SSH porta 3456
${fwcmd} add pass tcp from any to ${oip} 3456 setup

# Libera ping
${fwcmd} add allow icmp from any to any via ${oif}
${fwcmd} add allow icmp from any to any

#Bloqueia IPs
${fwcmd} add deny ip from 89.149.221.182 to any
${fwcmd} add deny ip from any to 89.149.221.182


#Bloqueio de FingerPrint
${fwcmd} add deny tcp from any to any tcpflags fin,urg,psh in recv $oif
${fwcmd} add deny tcp from any to any tcpflags
!fin,!syn,!ack,!urg,!psh,!rst in recv $oif
${fwcmd} add deny tcp from any to any tcpflags syn,fin,rst,ack in recv $oif
${fwcmd} add deny tcp from any to any tcpflags fin,!syn,!rst,!ack in recv $oif
${fwcmd} add deny tcp from any to any tcpflags syn,fin,!rst,!ack in recv $oif
${fwcmd} add deny tcp from any to any tcpflags urg,!syn,!fin,!rst,!ack
in recv $oif

# Libera consulta DNS
${fwcmd} add allow udp from me 1024-65535 to any 53 out keep-state uid bind
${fwcmd} add pass tcp from any to any 53 setup
${fwcmd} add pass udp from any to any 53
${fwcmd} add pass udp from any 53 to any
${fwcmd} add pass tcp from any 53 to any
${fwcmd} add pass udp from any to any 53 keep-state
${fwcmd} add pass tcp from any to any 53 keep-state


#Libera porta 80 e 21 para o ports
${fwcmd} add pass tcp from any to any 80 keep-state
${fwcmd} add pass tcp from any to any 20 keep-state
${fwcmd} add pass tcp from any to any 21 keep-state

#Libera porta NTP
${fwcmd} add pass udp from ${onet}:${omask} to ${CAIS} 123 keep-state
${fwcmd} add pass udp from ${CAIS} 123 to ${onet}:${omask} keep-state

# Bloqueia IP spoofing
${fwcmd} add deny all from ${onet}:${omask} to any in via ${oif}

# Allow TCP through if setup succeeded
${fwcmd} add pass tcp from any to any established

# Allow IP fragments to pass through
${fwcmd} add pass all from any to any frag
${fwcmd} add pass all from any to any frag

# Bloqueia pacotes com opcoes de Source Routing e Record
#Route do Cabecalho IP ativadas.
${fwcmd} add deny tcp from any to any ipoptions ssrr,lsrr,rr

#${fwcmd} add allow icmp from any to any in via ${oif} icmptype 0
#${fwcmd} add deny log icmp from any to any in via ${oif}
#${fwcmd} add allow icmp from any to any out via ${oif} icmptype 8
#${fwcmd} add deny log icmp from any to any out via ${oif}

#bloquear 5% dos pacotes de entrada, como se houvesse perda de pacotes
${fwcmd} add prob 0.05 deny in

#Qualquer outro trafego sera bloqueado e logado no arquivo de log
${fwcmd} add deny src-ip ${oip} via ${oif} keep-state

#Bloqueia Tudo
${fwcmd} add 65530 deny ip from any to any


Obrigada..