Date: Tue, 28 Nov 2006 10:35:43 -0800 From: Julian Elischer <julian@elischer.org> To: fulan Peng <fulanpeng@gmail.com> Cc: current@freebsd.org Subject: Re: FreeBSD 6.1 and 6.2 i386 firewall or NAT block web mail applications Message-ID: <456C817F.1020500@elischer.org> In-Reply-To: <bf0f1bc90611280147r709bec45v91c58fc50e7d56f2@mail.gmail.com> References: <bf0f1bc90611280147r709bec45v91c58fc50e7d56f2@mail.gmail.com>
next in thread | previous in thread | raw e-mail | index | archive | help
fulan Peng wrote:
> Hi,
> I need some help with FreeBSD firewall with NAT. I have made pppoe and
> NAT working with both 6.1 release and 6.2 RC i386. All I want is to
> forward port 443 to port 8843. I added a line in the OPEN portion in
> the rc.firewall file:
> ${fwcmd} add fwd 127.0.0.1,8843 tcp from any to any 443 in keep-state
how about:
${fwcmd} add fwd 127.0.0.1,8843 tcp from any to me 443 in keep-state
(or specify the actual address you want to forward)
> Now, when I type https://myserver's ip, it will forward to a proxy
> server listening at 8843. This is good. But, in the local network,
> nobody can access the yahoo and google mail.
> I made another kernel with the options IPFIREWALL_DEFAULT_TO_ACCEPT.
> When I ipfw, there is only one rule:
> allow ip from any to any
> This is good.
> When I added a line
> ipfw add fwd 127.0.0.1,8843 from any to any 443 in keep-state
> again, it won't work with any web email applications.
> I added a line like this
> ${fwcmd} add pass tcp from any to any 25 setup
> Still it won't work.
> pen at both 6.1 and 6.2 are not working. I remember it works only with
> 7.0-current.
> I have only 3 options when I compile the kernel:
> options IPFIREWALL
> options IPFIREWALL_FORWARD
> options IPDIVERT
>
> in order to get pppoe to work, I added
> options NETGRAPH
> options NETGRAPH_PPPOE
> options NETGRAPH_SOCKET
>
> my rc.conf is like this
> gateway_enable="YES"
> hostname=...
> ifconfig_ed0=...
> ppp_enable="YES"
> ppp_nat="YES"
> ppp_profile="sympatico"
> ppp_mode="ddial"
> firewall_enable="YES"
> firewall_type="OPEN"
>
> By the way, I have made this mistake twice:
> Comment out firewall_enable and firewall_type, the default rule is to
> lock out any body. I could not access my remote server. I wish you
> would not do this like me.
> The best way is to have an options IPFIREWALL_DEFAULT_TO_ACCEPT. The
> problem is : whenever you add some rule, it will block web mails!
> _______________________________________________
> freebsd-current@freebsd.org mailing list
> http://lists.freebsd.org/mailman/listinfo/freebsd-current
> To unsubscribe, send any mail to "freebsd-current-unsubscribe@freebsd.org"
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?456C817F.1020500>