From owner-freebsd-stable@FreeBSD.ORG Tue Mar 25 22:58:39 2003 Return-Path: Delivered-To: freebsd-stable@freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id D777737B412; Tue, 25 Mar 2003 22:58:38 -0800 (PST) Received: from umh001.norfolk.va.infi.net (umr001.norfolk.va.infi.net [209.97.16.105]) by mx1.FreeBSD.org (Postfix) with SMTP id CA3034413E; Tue, 25 Mar 2003 22:42:12 -0800 (PST) (envelope-from scotrn@cox.net) Received: through eSafe SMTP Relay 1045752069; Wed Mar 26 01:32:39 2003 Received: from inf032 (ip68-0-39-132.hr.hr.cox.net [68.0.39.132]) h2Q6aWFo015624; Wed, 26 Mar 2003 01:36:33 -0500 (EST) From: "Scot" To: "Ruslan Ermilov" , "Scot" Date: Wed, 26 Mar 2003 01:29:34 -0500 Message-ID: MIME-Version: 1.0 Content-Type: text/plain; charset="US-ASCII" Content-Transfer-Encoding: 7bit X-Priority: 3 (Normal) X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook IMO, Build 9.0.6604 (9.0.2911.0) In-reply-to: <20030325092007.GB73657@sunbay.com> X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1106 Importance: Normal X-Spam-Status: No, hits=-28.0 required=5.0 tests=EMAIL_ATTRIBUTION,HOT_NASTY,IN_REP_TO,MSGID_GOOD_EXCHANGE, ORIGINAL_MESSAGE,QUOTED_EMAIL_TEXT,REPLY_WITH_QUOTES version=2.50 X-Spam-Level: X-Spam-Checker-Version: SpamAssassin 2.50 (1.173-2003-02-20-exp) cc: FreeBSD Stable cc: ipfw@FreeBSD.ORG Subject: SUMMARY: Natd stops working on Firewall X-BeenThere: freebsd-stable@freebsd.org X-Mailman-Version: 2.1.1 Precedence: list List-Id: Production branch of FreeBSD source code List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 26 Mar 2003 06:58:55 -0000 X-List-Received-Date: Wed, 26 Mar 2003 06:58:55 -0000 Thanks to all who posted. Thanks Ruslan for the answer ! Simpel fix as Ruslan Explained. just add ... ${fwcmd} add pass all from ${inet}:${imask} to any in via ${iif} ${fwcmd} add pass ip from ${oip} to any out via ${oif} ${fwcmd} add pass ip from any to ${inet}:${imask} at the end of the SIMPLE section of rc.firewall. I added them just before # Everything else is denied by default, unless the # IPFIREWALL_DEFAULT_TO_ACCEPT option is set in your kernel # config file. ;; [Cc][Ll][Oo][Ss][Ee][Dd]) Yes I know, Now that I know it works I need to make it more resticted. The details of what started this thread. Following the FreeBSD Online handbook at http://www.freebsd.org/doc/en_US.ISO8859-1/books/handbook/firewalls.html I setup my firewall (initially) using the following rc.conf subsettings ifconfig_fxp0="DHCP" gateway_enable="YES" firewall_enable="YES" firewall_type="SIMPLE" natd_enable="YES" natd_interface="fxp0" natd_flags="" Added my DHCP ip and Local network to rc.firewall SIMPLE section and wala. It worked. But only for a little while. No logs or anything as to why... Hence the post and kind response below. Also: I added 15 lines of code to rc.firewall to dynamicly handle a DHCP address if you intrested here it is. I know my coding sucks but it works. -------------------------------------------------------------------------- # set these to your outside interface network and netmask and ip oif="fxp0" eval CHDHCP=\${ifconfig_$oif} if [ ${CHDHCP} = "DHCP" -a -r /var/db/dhclient.leases ];then lease="/var/db/dhclient.leases" oip=`grep fixed-address ${lease}|cut -d\; -f1|awk '{print $2}'|tail -1` omask=`grep subnet-mask ${lease}|cut -d\; -f1|awk '{print $3}'|tail -1` shortonet=`echo "$oip"|cut -d. -f1,2,3` onet="$shortonet.0" echo "DHCP onet = $onet" echo "DHCP omask = $omask" echo "DHCP oip = $oip" sleep 4 else # Add static address here onet="xxx.xxx.xxx.0" omask="255.255.255.0" oip="xxx.xxx.xxx.xxx" fi -----Original Message----- From: owner-freebsd-stable@FreeBSD.ORG [mailto:owner-freebsd-stable@FreeBSD.ORG]On Behalf Of Ruslan Ermilov Sent: Tuesday, March 25, 2003 4:20 AM To: Scot Cc: FreeBSD Stable; ipfw@FreeBSD.ORG Subject: Re: Natd stops working on Firewall On Mon, Mar 24, 2003 at 09:52:32PM -0500, Scot wrote: > Hi; > > Just setup my FreeBSD 4.7 Firewall using the docs > outlined in the handbook. > What docs you have used to set up the firewall? > The install went on and > everything seems to be working fine then boom. > The system seems to stop routing traffic. No > messages in the security log or natd log as to why. > > I made sure it was logging by nmaping my box from the > outside. I even ran natd in the foreground and it still didn't > tell me what was going on. > > There is nothing in any logfile that tells me why this thing > just stops working so I'm thinking it may not be a daemon but > something in the kernel. > > I cannot ping the interface from the internal network but tcpdump shows > the packets being received. (Hub network firewall_type=SIMPLE ). > > If I logon to the console the cable modem connection is still functioning > and I can surf from the firewall. > > Any ideas on where to look next ?? > > > Cable modem using dhcp -> 192.168 home network on > PPro w/280 MB ram. > Intel Pro 10/100b/100+ Ethernet This card is a PCI card with 2 interfaces. > Standard Xuser install + Kernel sources. > I've been through this just recently. Our "simple" prototype is not production ready; if you just tune oip/iip/onet/inet, etc., it won't allow your internal machines to talk outside. The packet flow for a machine in ${inet}:${imask} talking outside is as follows: ${inet}:${imask} -> some_host (in via ${iif}) ${oip} -> some_host (out via ${oif}) (after NAT) some_host -> ${inet}:${imask} (in via ${oif}) (after de-NAT) some_host -> ${inet}:${imask} (out via ${iif}) (This assumes that you NAT using ${oip}, which is not always the case.) So, to make it work (if default is to "deny"), you need to add the following rules at the end of the ruleset: ${fwcmd} add pass all from ${inet}:${imask} to any in via ${iif} ${fwcmd} add pass ip from ${oip} to any out via ${oif} ${fwcmd} add pass ip from any to ${inet}:${imask} Cheers, -- Ruslan Ermilov Sysadmin and DBA, ru@sunbay.com Sunbay Software AG, ru@FreeBSD.org FreeBSD committer, +380.652.512.251 Simferopol, Ukraine http://www.FreeBSD.org The Power To Serve http://www.oracle.com Enabling The Information Age