Date: Sun, 7 Jul 2002 22:34:08 -0700 From: Christian Chen <oistrakh@earthlink.net> To: Brossin Pierrick <pbrossin@wxp.homeip.net> Cc: freebsd-stable@FreeBSD.ORG Subject: Re: FreeBSD Server and Gateway Message-ID: <20020708053408.GA28499@earthlink.net> In-Reply-To: <000301c225f0$e43dcf70$3200000a@nitrox> References: <000801c225c9$bba4d030$3200000a@nitrox> <20020707173947.GA250@theshell.com> <000301c225f0$e43dcf70$3200000a@nitrox>
next in thread | previous in thread | raw e-mail | index | archive | help
Trying to do firewall/NAT/gateway via PPPoE under FreeBSD is a bit tricky. Most HOWTO's that I've found only deal with this via a less lame internet connection. But basically, you need to get PPPoE up and running first. There are several HOWTOs for setting that up. Assuming that you have that running, you will then have an internet connection via tun0. What will happen once you have everything set up is that any packets from other machines on your internal network are going to come in via your ethernet connection (let's say xl0), get routed to tun0 by NAT, and then go out through tun0 to the internet. The process will be reversed when the packets come back in. So, theoretically what you need to do is: 1. Set up NAT to route between your ethernet card and tun0 2. Set up a set of firewall rules using ipf that will block certain traffic trying to come in from tun0 and go to NAT. Problem is, I could never actually get step 2 to work properly. I'm certainly not a networking guru, so I'm sure it's my own incompetence that prevented me from getting it to work. But what I've found works equally well (at least, I *think* it's working equally well!) is to use the firewall features of PPP to block incoming packets on tun0. "man ppp.conf" will tell you how to set this up, and there are also examples in /usr/share/examples/ppp. So, what I'm actually doing is: 1. Set up NAT to route between my ethernet card and tun0 2. Set up the firewall rules via PPP I'm not running ipf at all. This appears to work properly from all the testing I've been able to do. Whether it works as efficiently as ipf would, or is flexible enough for your needs, I don't know. Christian Chen On Sun, Jul 07, 2002 at 10:00:07PM +0200, Brossin Pierrick wrote: > As you may see, I'm really confused with IPFilter NAT IP Masquerading .... > Can someone take the time to explain or give the url of a page please.. I > can't find any ? > > Regards, > > Pierrick > > > > To Unsubscribe: send mail to majordomo@FreeBSD.org > with "unsubscribe freebsd-stable" in the body of the message To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-stable" in the body of the message
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20020708053408.GA28499>