Date: Wed, 20 Dec 2000 09:57:18 -0800 (PST) From: Luigi Rizzo <rizzo@aciri.org> To: freebsd@canyon.demon.nl (Rene de Vries) Cc: freebsd-hackers@FreeBSD.ORG Subject: Re: statefull packet filter together with natd question Message-ID: <200012201757.eBKHvIb77566@iguana.aciri.org> In-Reply-To: <20001220184937.A788@canyon.demon.nl> from Rene de Vries at "Dec 20, 2000 6:49:37 pm"
next in thread | previous in thread | raw e-mail | index | archive | help
> Hello, > > Some time a go I posted the same question to freebsd-questions, but uptill now > I didn't get an answer. > > Currently I'm trying to move towards a statefull packet filter. When testing > without nat all seems to work fine. But when I added natd (as the first > rule) packets that were natd-ed on their way out had their return traffic > blocked. The question is, what am I doing wrong?!? nat changes addresses and then reinjects packets in the firewall. Chances are that there is no dynamic rule matching the packet after the translation. cheers luigi > I hope somebody can tell me how to solve this problem. > > Rene > > from my logs: > > ipfw: Accept TCP 212.238.x.x:1026 x.x.x.x:23 out via isp0 > ipfw: Deny TCP x.x.x.x:23 192.168.1.3:1026 in via isp0 > > ipfw rules: > > /sbin/ipfw -f flush > > /sbin/ipfw -q add divert natd all from any to any via isp0 > > /sbin/ipfw -q add allow all from any to any via lo0 > /sbin/ipfw -q add allow all from any to any via dc0 > > /sbin/ipfw -q add check-state from any to any via isp0 > /sbin/ipfw -q add deny log tcp from any to any established > /sbin/ipfw -q add allow all from any to any out via isp0 keep-state > > /sbin/ipfw -q add deny log all from any to any > > -- > Rene de Vries http://www.tcja.nl mailto:rene@tcja.nl > > > To Unsubscribe: send mail to majordomo@FreeBSD.org > with "unsubscribe freebsd-hackers" in the body of the message > To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-hackers" in the body of the message
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?200012201757.eBKHvIb77566>