My Look'n'Stop Ruleset

Here is the Look'n'Stop homepage

(The french version contains slightly more info, e.g. FAQ ;-)

Here you can even download the ruleset file. Note that I've changed all "My IP"s and MAC adresses to 0.0.0.0 resp. 00:00:00:00:00:00. Right now i've fixed a small problem in the Tracert rule: it was to filter on ICMP types all, 11 - now that's equal 11. Maybe i'll change some few things more - I'll tell you when. Ah yes, one more thing: in the downloadable .rls set, there is a loopback rule that up to now appears only in the table at the very bottom and not at all in the ruleset overview snapshot...

TCP Rules
Blocking
Block Land Attack	Block Winnuke
Block outbound traffic from localhost:80	Block outbound traffic from a local SubSeven Server (on 27374)
Allowing
Allow POP and SMTP for Mail	Allow HTTP and HTTPS
Allow FTP2	Allow NNTP for Usenet
Allow IRC	Allow IRC's DCC3
Allow Telnet	Allow Ident queries (needed by some IRC servers)
Allow to finger someone else	Allow Proxies at ports 8000-8888
Allow Proxies at 1080 and 3128	Allow Whois on someone else (needed for some Trace Apps)
Allow Hosts2-NS Protocol (What's this for?)4
UDP Rules
Blocking
Block NetBIOS	Block inbound UDP broadcast
Block unnecessary bootp - has to precede "Allow Bootp"
Allowing
Allow Bootp	Allow DNS
Allow SNTP Time Synch.	Allow outbound UDP broadcast
ICMP Rules
Allowing
Allow Ping others (request)	Allow Ping others (response)
Allow Tracert
Blocking
Block ICMP Type 10
ARP Rules
Allowing
Allow ARP replies coming in from my gateway	Allow ARP requests broadcasting out

1. I have not added the "Termination Rules". They are the same as in the default ruleset.
2. FTP is a tricky issue. Often - and especially if you're not using an FTP Client like CuteFTP, but rather your Browser's FTP or Getright, Go!Zilla, etc. - connections open up on totally arbitrary ports (in the range of local:1024-5000 however). I have not been able to cope with this up to now but rather am temporarily disabling TCP and General Termination Rules - very bad solution indeed...
3. I have configured my IRC client to have its DCC Server listen on port 7700 and to use ports 7701-7800 for transfers.
4. I have no idea what this hosts2-ns protocol is supposed to accomplish. It showed in my log when i wanted to download something from CNet...

There are infinitely more ressources at the Look'n'Stop Forum which is part of the Becky Users Forums.

Rules provided by other people
Maddoktor2's ICQ rules
ICQ Server connection	ICQ Client to Client	ICQ rule ordering
Federic's Napster & Mail rules
Napster Rule 1	Napster Rule 2	Mail Rule
other rules of myself that are not used
Block Servers on port 110 (e.g. POProxy) from sending out data	Block clients on your comp. from connecting to Sub7 Servers	Loopback Rule for 127.0.0.1
I hope I have not forgotten any... If i did, please mail me.