freebsd security - Jan 2005 - ipf question

Hello.

I am a relatively new FreeBSD user. I have samba, ssh and vnc server running
on it. I am also trying to set up the IPFILTER on it. I used the handbook to
familiarize myself with the software and the sample script provided in the
chapter discussing ipf, I decided to use as a starting point. After reading
the ipf chapter I assumed that if "block in log first quick on xl0
all" is
used, everything which is not opened by default will be blocked.
Now I opened only samba and ssh ports:
pass in quick on xl0 proto tcp/udp from any to any port 137 <> 139 keep
state
pass in quick on xl0 proto tcp/udp from any to any port = 445 keep state
pass in quick on xl0 proto tcp from any to any port = 22 flags S keep state

However I am able to connect to the vncserver, without actually opening it
in the script.
I guess my assumption was wrong, please let me know if I missed on
something.

Michael

:: pass in quick on xl0 proto tcp/udp from any to any port 137 <> 139 keep
:: state

This line allows in all tcp and udp ports less than 137 and greater than 
139, which is exactly what you don't want :)  If you want to allow all 
ports 137-139 inclusive, you need to change it to

  ... port 136 >< 140 keep state

The < and > operators are not inclusive.

Cheers - Erick