From owner-freebsd-ipfw@FreeBSD.ORG Fri Apr 28 14:52:07 2006 Return-Path: X-Original-To: ipfw@freebsd.org Delivered-To: freebsd-ipfw@FreeBSD.ORG Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id 4EA5716A40D for ; Fri, 28 Apr 2006 14:52:07 +0000 (UTC) (envelope-from vladone@spaingsm.com) Received: from mail.spaingsm.com (llwb135.servidoresdns.net [217.76.137.82]) by mx1.FreeBSD.org (Postfix) with ESMTP id 54DBF43D55 for ; Fri, 28 Apr 2006 14:52:02 +0000 (GMT) (envelope-from vladone@spaingsm.com) Received: from SERVER (unknown [88.158.112.6]) (using TLSv1 with cipher AES256-SHA (256/256 bits)) (No client certificate requested) by mail.spaingsm.com (Postfix) with ESMTP id D614124C5C0 for ; Fri, 28 Apr 2006 16:26:24 +0200 (CEST) Date: Fri, 28 Apr 2006 17:52:00 +0300 From: vladone X-Mailer: The Bat! (v3.62.14) Professional X-Priority: 3 (Normal) Message-ID: <1753864896.20060428175200@spaingsm.com> To: ipfw@freebsd.org In-Reply-To: References: MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: 7bit Cc: Subject: Re: IPTABLES to IPFW for Packet Inspection Filtering X-BeenThere: freebsd-ipfw@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list Reply-To: vladone List-Id: IPFW Technical Discussions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 28 Apr 2006 14:52:09 -0000 Hello Daniel, Thursday, April 27, 2006, 9:13:02 PM, you wrote: > hey all, > here's what I'm looking to do. I know it could be done with IPTABLES, but > as it's not available for the Mac OS X I'm trying to figure out how it > would be done in IPFW ... > RELAY is a workstation forwarding packets from a SOURCE workstation to all > DESTINATION end points. RELAY is able to receive all packets from SOURCE > bound to DESTINATION. I want RELAY to deny packets forwarding from SOURCE > that are name resolution attempts to DESTINATION DNS server specifically > for host WWW.YAHOO.COM (for example). To do this I need to create a rule > that will look into the Data field of an DNS packet and match the query. > The Data field of a DNS query packet would be written in hex. > With IPTABLES I would write something like this: > RELAY # iptables -I FORWARD 1 -p udp --dport 53 -m string --hex-string U have in man ipfw explanation for this. src and dst: {addr | { addr or ... }} [[not] ports] An address (or a list, see below) optionally followed by ports specifiers. The second format ( or-block with multiple addresses) is provided for convenience only and its use is discouraged. addr: [not] {any | me | addr-list | addr-set} any matches any IP address. me matches any IP address configured on an interface in the system. The address list is evaluated at the time the packet is analysed. addr-list: ip-addr[,addr-list] ip-addr: A host or subnet address specified in one of the following ways: numeric-ip | hostname Matches a single IPv4 address, specified as dotted-quad or a hostname. Hostnames are resolved at the time the rule is added to the firewall list. So if u want to deny packets from some hostname u have an rule like: ipfw add 100 deny ip from me to www.hahoo.com -- Best regards, vladone mailto:vladone@spaingsm.com