From owner-freebsd-questions Mon Jan 22 22:31:32 2001 Delivered-To: freebsd-questions@freebsd.org Received: from rm-rstar.sfu.ca (rm-rstar.sfu.ca [142.58.120.21]) by hub.freebsd.org (Postfix) with ESMTP id 48E8937B400 for ; Mon, 22 Jan 2001 22:31:14 -0800 (PST) Received: from fraser.sfu.ca (tmchow@fraser.sfu.ca [142.58.101.25]) by rm-rstar.sfu.ca (8.10.1/8.10.1/SFU-5.0H) with ESMTP id f0N6VDM17403 for ; Mon, 22 Jan 2001 22:31:13 -0800 (PST) Received: from localhost (tmchow@localhost) by fraser.sfu.ca (8.9.2/8.9.2/SFU-5.0C) with ESMTP id WAA24041 for ; Mon, 22 Jan 2001 22:31:13 -0800 (PST) X-Authentication-Warning: fraser.sfu.ca: tmchow owned process doing -bs Date: Mon, 22 Jan 2001 22:31:13 -0800 (PST) From: Trevin Chow To: Subject: broken NAT and Firewall rule Message-ID: MIME-Version: 1.0 Content-Type: TEXT/PLAIN; charset=US-ASCII Sender: owner-freebsd-questions@FreeBSD.ORG Precedence: bulk X-Loop: FreeBSD.ORG I previously wrote to the email list about my problems with NAT and my firewall rules... in a nutshell NAT doesnt' work =) The freeBSD 4.2-Stable box can reach the internet, and is running sshd and proftd with no problems. However, when I connect one of my internal machines to the internal interfaces on the server, the internet on those clients doesn't function. TO provide more useful logs of `ipfw show`, I zero'd it out first with `ipfw zero`, then I did a simple request to load up a webpage in IE 5.5 on the client machine hooked up to my internal interface. External Interface = dc0 Internal interfaces = fxp0 and fxp1 Connected client onto fxp1 and tried to loadup up yahoo.com ------------------ 00100 0 0 allow ip from any to any via lo0 00200 0 0 deny ip from any to 127.0.0.0/8 00300 28 3780 divert 8668 ip from any to any via dc0 00400 0 0 deny ip from 192.168.0.0/24 to any in recv dc0 00500 0 0 deny ip from 209.53.0.0/18 to any in recv fxp0 00600 0 0 deny ip from 209.53.0.0/18 to any in recv fxp1 00700 0 0 deny ip from 192.168.0.0/16 to any in recv dc0 00800 0 0 deny ip from 172.16.0.0/12 to any in recv dc0 00900 0 0 deny ip from 224.0.0.0/4 to any 01000 0 0 deny ip from 10.0.0.0/8 to any in recv dc0 01100 14 812 allow ip from any to any out xmit dc0 01200 0 0 allow ip from any to any via fxp0 01300 14 812 allow ip from any to any via fxp1 01400 0 0 allow tcp from any to any in recv dc0 established 01500 0 0 allow tcp from 142.58.101.25 to 209.53.60.139 2626 setup 01600 0 0 allow tcp from 142.58.107.12 to 209.53.60.139 2626 setup 01700 0 0 allow log logamount 100 tcp from 142.58.101.25 to 209.53.60.139 2627 in recv dc0 setup 01800 0 0 allow log logamount 100 tcp from 142.58.107.12 to 209.53.60.139 2627 in recv dc0 setup 01900 0 0 allow log logamount 100 tcp from 24.71.46.74 to 209.53.60.139 2627 in recv dc0 setup 02000 0 0 allow log logamount 100 tcp from 209.53.63.29 to 209.53.60.139 2627 in recv dc0 setup 02100 0 0 allow log logamount 100 tcp from 24.113.38.121 to 209.53.60.139 2627 in recv dc0 setup 02200 0 0 allow tcp from any to 209.53.60.139 80 setup 02300 0 0 allow tcp from any to 209.53.60.139 25 setup 02400 0 0 allow tcp from 142.58.101.25 to 209.53.60.139 110 setup 02500 0 0 allow tcp from 24.113.77.121 to 209.53.60.139 110 setup 02600 0 0 allow udp from any 123 to 209.53.60.139 02700 0 0 allow udp from 209.53.60.139 to any 123 02800 0 0 allow udp from any to 209.53.60.139 53 02900 0 0 allow udp from 209.53.60.139 53 to any 03000 0 0 allow tcp from any to 209.53.60.139 53 setup 03100 0 0 allow tcp from any to 209.53.60.139 194 03200 0 0 allow udp from any to 209.53.60.139 194 03300 0 0 deny log logamount 100 tcp from any to any in recv dc0 setup 03400 0 0 allow icmp from any to any via fxp0 03500 0 0 allow icmp from any to any via fxp1 03600 0 0 allow icmp from any to any in recv dc0 icmptype 0 03700 0 0 allow icmp from any to any out xmit dc0 icmptype 8 03800 0 0 allow udp from any to any 33434-33523 out xmit dc0 03900 0 0 allow icmp from any to any via dc0 icmptype 3,4,11,12 65532 14 2968 deny udp from any to any 65533 0 0 deny icmp from any to any 65534 0 0 deny log logamount 100 ip from any to any 65535 0 0 deny ip from any to any To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-questions" in the body of the message