Date: Fri, 29 Sep 2000 03:43:06 -0600 From: James Gorham <james@veldt.com> To: Fred Condo <fred@condo.chico.ca.us> Subject: Help! IPFW Problems Message-ID: <p05001902b5fa1478d1c7@[192.168.1.2]>
next in thread | raw e-mail | index | archive | help
Greetings. I'm having quite a bit of trouble, and it seems to be related to IP Divert and/or IP firewall. A bit of background... I compiled a custom kernel when I first installed FreeBSD, with: options IPDIVERT options IPFIREWALL as the only custom options from the GENERIC config, other than some custom screen colors. I ran my local network of a FreeBSD machine acting as the gateway for a single IP DSL connection to 2 macs on the LAN. It worked fine until I decided to install netatalk. I added the: options NETATALK to the same kernel file I used originally, config'd the file, make depend, make, and make install'd the kernel. Upon reboot I began getting messages such as: 00100 allow ip from any to any via lo0 ifw: setsockopt(IP_FW_ADD): Invalid argument 00200 deny ip from any to 127.0.0.0/8 ipfw: setsockop(IP_FW-AD): Invalid Argument 65000 allow ip from any to any ipfw: setsockopt(IP_FW_ADD): Invalid argument during boot process. After booting, and logging in, all tcp/ip functions were unavailble. Things like ping, would get: sendto: Permission denied. I tried removing the netatalk option from the Kernel file, recompiling and installing, and STILL get the ipfw errors. I had the following two lines in my rc.conf file: firewall_enable="YES" firewall_type="open" Originally (before the netatalk compile) these worked fine. If I comment these two lines out now, I can do my TCP/IP functions, but I cannot get any of the machines on the LAN on the internet, due to natd not being enabled. I gave up, and tried compiling the GENERIC kernel. After installing this kernel, I still cannot leave the above two lines in my rc.conf uncommented, or else I'll have no tcp/ip functions. I've never touched the rc.firewall file, nor have I ever cvsup'd the /usr/src directory. I've only updated the /usr/ports. If you have any idea at all as to what I should do, please let me know. I'm in dire need to get these machines back online. Best regards, james To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-questions" in the body of the message
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?p05001902b5fa1478d1c7>