Date: Thu, 22 Feb 2001 08:12:56 -0800 From: "Crist J. Clark" <cjclark@reflexnet.net> To: "Michael J. Turner" <mike@inethouston.net> Cc: greg@nova.fqdn.com, freebsd-questions@FreeBSD.ORG, greg@fqdn.com Subject: Re: NAT and keep-state issue. Message-ID: <20010222081256.I89396@rfx-216-196-73-168.users.reflex> In-Reply-To: <005701c09cc6$8c057740$0204a8c0@daimon>; from mike@inethouston.net on Thu, Feb 22, 2001 at 05:56:51AM -0600 References: <200102212004.PAA42475@nova.fqdn.com> <20010222001834.D89396@rfx-216-196-73-168.users.reflex> <005701c09cc6$8c057740$0204a8c0@daimon>
next in thread | previous in thread | raw e-mail | index | archive | help
On Thu, Feb 22, 2001 at 05:56:51AM -0600, Michael J. Turner wrote: > I am having the same problem with natd and ipfw, the fact that you have > to "allow all from any to any" for nat to work is ridiculous, Yes, it would. Fortunately, it is not the case. > also the > dynamic > rules factory. Anyhow the only way I think I can solve the problem is to > move > ipnat and ipf. My natd(8) and dynamic rules work fine. Excerpts from the firewall rules, 10000 divert 8668 ip from any to any via ${oif} 10100 check-state 10200 allow tcp from ${oip} to any keep-state out xmit ${oif} 20000 deny udp from any 137-138 to ${obc} 137-138 in recv ${oif} 20100 allow udp from ${oip} to any keep-state out xmit ${oif} 20200 allow icmp from ${oip} to any keep-state out xmit ${oif} 20300 allow ip from ${oip} to any keep-state out xmit ${oif} 20400 allow icmp from any to any icmptype 0,3,11 20500 allow ip from ${inet} to ${iip} in recv ${iif} 20600 allow ip from ${iip} to ${inet} out xmit ${iif} 20700 allow ip from ${inet} to any keep-state in recv ${iif} For example, I just pinged freebsd.org from a machine on the internal net, ## Dynamic rules: 20700 9 756 (T 56, # 12) ty 0 icmp, 192.168.AAA.30 0 <-> 216.136.204.18 0 20200 3 252 (T 56, # 186) ty 0 icmp, BBB.CCC.DDD.EEE 0 <-> 216.136.204.18 0 -- Crist J. Clark cjclark@alum.mit.edu To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-questions" in the body of the message
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20010222081256.I89396>