Date: Wed, 14 May 2003 17:34:05 -0700 From: "Crist J. Clark" <crist.clark@attbi.com> To: xskoba1@kremilek.gyrec.cz Cc: freebsd-security@freebsd.org Subject: Re: bridge and firewall Message-ID: <20030515003405.GA83387@blossom.cjclark.org> In-Reply-To: <Pine.LNX.4.44.0305081228280.31254-100000@kremilek.gyrec.cz> References: <Pine.LNX.4.44.0305081228280.31254-100000@kremilek.gyrec.cz>
next in thread | previous in thread | raw e-mail | index | archive | help
On Thu, May 08, 2003 at 12:39:11PM +0200, xskoba1@kremilek.gyrec.cz wrote:
> Can anyone help with this. Bridge is enabled, even in sysctl. Firewall is
> enabled and configured. But my reality is done this way..
>
>
> Cisco
> (NATing
> 192.168.1.0/24) ---- Freebsd Bridge (Public IP) ------ stations
> (Public IP) (NATing 172.16.0.0/24 192.168.1.xx
> or something similar) 172.16.0.xx and on
> one public IP one private witch even one
> public IP...
>
> ok... it looks horribly, but I am not having time to change it... we are
> going to change IPS and so on...
>
> so... what are the rules which should be added
>
> users are permited to connect inside.... to public IP trough SSH
> named is on FreeBSD and used by inner adress (192... 172...)
>
> and firewall than behaves strangely...
>
> thanks for any idea, unless you want me to reconfigure it at all... it is
> a school and I am not having time until holiday
Bridged packets only go through firewall processing on input. If you
have a,
divert natd ip from any to any via if0
(Where if0 is the external interface) it will not work since packets
going out the interface never hit that rule.
--
Crist J. Clark | cjclark@alum.mit.edu
| cjclark@jhu.edu
http://people.freebsd.org/~cjc/ | cjc@freebsd.org
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20030515003405.GA83387>