From owner-freebsd-questions@FreeBSD.ORG Wed May 7 09:29:50 2003 Return-Path: Delivered-To: freebsd-questions@freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id 7F7ED37B401 for ; Wed, 7 May 2003 09:29:50 -0700 (PDT) Received: from sccrmhc03.attbi.com (sccrmhc03.attbi.com [204.127.202.63]) by mx1.FreeBSD.org (Postfix) with ESMTP id 92C2143FAF for ; Wed, 7 May 2003 09:29:49 -0700 (PDT) (envelope-from freebsd-questions-local@be-well.no-ip.com) Received: from be-well.ilk.org (lowellg.ne.client2.attbi.com[24.147.188.198]) by attbi.com (sccrmhc03) with ESMTP id <2003050716294800300d4ld5e>; Wed, 7 May 2003 16:29:48 +0000 Received: from be-well.ilk.org (lowellg.ne.client2.attbi.com [24.147.188.198] (may be forged)) by be-well.ilk.org (8.12.9/8.12.7) with ESMTP id h47GTlTU011864; Wed, 7 May 2003 12:29:47 -0400 (EDT) (envelope-from freebsd-questions-local@be-well.no-ip.com) Received: (from lowell@localhost) by be-well.ilk.org (8.12.9/8.12.6/Submit) id h47GTkMU011861; Wed, 7 May 2003 12:29:46 -0400 (EDT) X-Authentication-Warning: be-well.ilk.org: lowell set sender to freebsd-questions-local@be-well.ilk.org using -f Sender: lowell@be-well.no-ip.com To: freebsd-questions@freebsd.org References: <20030504020843.6a4fd568.bsdwave@go.ro> From: Lowell Gilbert Date: 07 May 2003 12:29:46 -0400 In-Reply-To: <20030504020843.6a4fd568.bsdwave@go.ro> Message-ID: <44d6iu90ud.fsf@be-well.ilk.org> Lines: 47 User-Agent: Gnus/5.09 (Gnus v5.9.0) Emacs/21.3 MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii cc: Rapier Subject: Re: ipfw problem X-BeenThere: freebsd-questions@freebsd.org X-Mailman-Version: 2.1.1 Precedence: list Reply-To: freebsd-questions@freebsd.org List-Id: User questions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 07 May 2003 16:29:50 -0000 Rapier writes: > Hello everyone, > I have a small home network with 3 boxes behind a FreeBSD 4.7-RELEASE(natd).I had to allow outbound tcp 5200 from 192.168.0.3,and 5198,5199 udp outbound and inbound from the same box,did that with natd -redirect-port.Everything was fine when i had ipfw add allow ip from any to any.I put up a small firewall and cannot seem to figure it out why it ain't working(redirecting those 2 udp's).Nothing shows up denied in the firewall's log.The accounting to those 2 udp's remain 0.Something is messed in my firewall rulles,i need a little help please.Here is my firewall: I would guess that your keep-state rules aren't doing what you expect. ipfw's state-keeping doesn't mix well with NAT. In this case, I think what's happening is that the incoming interface information has already been lost (by the pass through natd) before the state is checked. > ################################################################ > 00100 436 20928 allow tcp from any to any 5200 via any > 00110 0 0 allow udp from any to any 5198 via any > 00120 0 0 allow udp from any to any 5199 via any > 01000 0 0 deny log logamount 100 ip from 10.0.0.0/8 to any in recv rl0 > 01100 0 0 deny log logamount 100 ip from 172.16.0.0/12 to any in recv rl0 > 02000 6 240 allow ip from any to any via lo0 > 02100 0 0 deny log logamount 100 tcp from any to any in tcpflags fin,syn > 02150 0 0 deny log logamount 100 ip from any to any in recv any frag > 02200 3 132 reset tcp from any to any 113 > 02300 6452 5118652 divert 8668 ip from any to any via rl0 > 03000 0 0 allow icmp from any to any icmptype 3 > 03100 0 0 allow icmp from any to any icmptype 4 > 03200 0 0 allow icmp from any to any out icmptype 8 > 03300 0 0 allow icmp from any to any in icmptype 0 > 03400 0 0 allow icmp from any to any in icmptype 11 > 04000 0 0 check-state > 04200 81 8934 deny log logamount 100 tcp from any to any in established > 04300 67 11835 allow udp from 192.168.0.0/24 to any keep-state via rl1 > 04400 12506 10342918 allow tcp from 192.168.0.0/24 to any keep-state via rl1 setup > 04500 30 2396 allow udp from 81.196.89.85 to any keep-state via rl0 > 04600 2818 117654 allow tcp from 81.196.89.85 to any keep-state via rl0 > 65000 26 1872 deny log logamount 1000 ip from any to any > 65535 0 0 deny ip from any to any > > ################################################################ > --------------------------------------------------- > "Definitions of hardware and software for dummies: > > Hardware is what you kick; > Software is what you curse." > > _______________________________________________ > freebsd-questions@freebsd.org mailing list > http://lists.freebsd.org/mailman/listinfo/freebsd-questions > To unsubscribe, send any mail to "freebsd-questions-unsubscribe@freebsd.org"