up vote 0 down vote favorite
share [g+] share [fb]

I running on Solaris 10 platform.

Before I enable IPF, I able to ping and traceroute to yahoo.com

After I enabled the IPf, I could not ping nor traceroute to yahoo.com However when I ping to IP 69.147.114.224 (one of yahoo resolved IP) directly, it gives me response.

It seem to be that IPF block the DNS resolvability.

How could I solve it?

link|improve this question
91% accept rate
feedback

2 Answers

up vote 3 down vote accepted

Add a firewall rule to allow UDP and TCP traffic on port 53.

link|improve this answer
UDP is a minimum default, since TCP is used to perform huge things like zone transfers between servers. DNS clients usually don't need that. – Anonymous Dec 14 '09 at 6:10
Do not block DNS over TCP, you'll break large UDP responses. See tools.ietf.org/html/draft-ietf-dnsext-dns-tcp-requirements-01 – Alnitak Dec 14 '09 at 8:58
feedback
up vote 0 down vote

Add the pass out rule: pass out quick from any to any keep state

link|improve this answer
feedback

Your Answer

 
or
required, but never shown
discard

Not the answer you're looking for? Browse other questions tagged or ask your own question.