From owner-freebsd-questions Thu Mar 29 20:13:55 2001 Delivered-To: freebsd-questions@freebsd.org Received: from mail.gmx.net (pop.gmx.net [194.221.183.20]) by hub.freebsd.org (Postfix) with SMTP id 05DBC37B71C for ; Thu, 29 Mar 2001 20:13:52 -0800 (PST) (envelope-from michaelnottebrock@gmx.net) Received: (qmail 23075 invoked by uid 0); 30 Mar 2001 04:13:50 -0000 Received: from pd4b9ef95.dip.t-dialin.net (HELO lofizwei) (212.185.239.149) by mail.gmx.net (mp025-rz3) with SMTP; 30 Mar 2001 04:13:50 -0000 Message-ID: <012601c0b8cf$f27ea120$0508a8c0@lofi.dyndns.org> From: "Michael Nottebrock" To: Subject: natd / ipfw question: How to deny nat for certain machines Date: Fri, 30 Mar 2001 06:14:41 +0200 MIME-Version: 1.0 Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: 7bit X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 5.50.4522.1200 X-MimeOLE: Produced By Microsoft MimeOLE V5.50.4522.1200 Sender: owner-freebsd-questions@FreeBSD.ORG Precedence: bulk X-Loop: FreeBSD.ORG I am using a a FreeBSD box to connect to my ISP via DSL, using the userland ppp on FreeBSD Release 4.2. I am also running natd, dhcpd and the dante-socks proxy in order to provide convenient access to the internet to some windows boxes on my LAN. The LAN and the DSL-modem are connected to different NICs. I would now like to allow nat only for a certain range of IP-Adresses (say 192.168.8.1-8) and disallow it for everyone else. I have setup the following basic ipfw-configuration, which allows everyone on the internal net to access the internet via NAT: (from /etc/rc.conf) natd_interface="tun0" natd_flags="-dynamic -l -unregistered_only" (ipfw-ruleset) add 50 divert natd all from any to any add 51 divert 1234 tcp from any to any ; mss-clamping, necessary for dsl because of ISPs blackhole routers add 100 pass all from any to any via lo0 add 200 deny all from any to any 127.0.0.0/8 [...] ; some unreach port rules for the tun0 interface add 500 pass all from any to any Any help is greatly appreciated. Thanks in advance, Michael Nottebrock To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-questions" in the body of the message