From owner-freebsd-questions Sat Jan 12 1:50:34 2002 Delivered-To: freebsd-questions@freebsd.org Received: from viefep12-int.chello.at (viefep12-int.chello.at [213.46.255.25]) by hub.freebsd.org (Postfix) with ESMTP id A3C1E37B420 for ; Sat, 12 Jan 2002 01:49:56 -0800 (PST) Received: from unet.univie.ac.at ([62.178.142.175]) by viefep12-int.chello.at (InterMail vM.5.01.03.06 201-253-122-118-106-20010523) with ESMTP id <20020112094955.XWGD1239.viefep12-int.chello.at@unet.univie.ac.at> for ; Sat, 12 Jan 2002 10:49:55 +0100 Message-ID: <3C187D20.E1901AD5@unet.univie.ac.at> Date: Thu, 13 Dec 2001 11:04:16 +0100 From: Peter Wolkerstorfer X-Mailer: Mozilla 4.73 [de]C-CCK-MCD QXW03240 (Win98; U) X-Accept-Language: de,en MIME-Version: 1.0 To: freebsd-questions@freebsd.org Subject: please help on 1(one) ipf rule Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: 7bit Sender: owner-freebsd-questions@FreeBSD.ORG Precedence: bulk List-ID: List-Archive: (Web Archive) List-Help: (List Instructions) List-Subscribe: List-Unsubscribe: X-Loop: FreeBSD.ORG dear listmembers, i would need some help on ipf problem: ipf firewall with ipnat won't allow to login on itself and won't allow outgoing traffic from itself. form the intranet (192.168.0..0/8) to the internet all works as i wanted. my ipf.rules is: # i have read this should be better for scans block return-rst in log quick on rl1 proto tcp all # i want to block all the rest with this block in quick on rl1 all # this is my not working try of making a ssh-connection to the firewall working pass in quick on rl0 proto tcp/udp from 192.168.0.0/8 to any keep state pass out quick on rl0 proto tcp/udp from 192.168.0.0/8 to any keep state #the rest which seems to work pass out quick on rl1 proto tcp from 192.168.0.0/8 to any keep state pass out quick on rl1 proto udp from 192.168.0.0/8 to any keep state pass out quick on rl1 proto icmp from 192.168.0.0/8 to any keep state my ipnat.rules is: map rl1 192.168.0.0/24 -> 0/32 i would now need one ipf rule which at least allows logging in on the firewall with ssh. it would be better if i could acces the net from the firewall-console, too. THX in advance peter "wolki" wolkerstorfer p.s.: please tell me if i should have asked this in freebsd-security To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-questions" in the body of the message