Date: Thu, 18 Jan 2001 20:59:04 -0800 From: "Crist J. Clark" <cjclark@reflexnet.net> To: Trevin Chow <tmchow@sfu.ca> Cc: Bill Moran <wmoran@mail.iowna.com>, questions@FreeBSD.ORG Subject: Re: NAT doesn't work with my firewall rules? Message-ID: <20010118205904.C66998@rfx-216-196-73-168.users.reflex> In-Reply-To: <5.0.2.1.2.20010118151323.02be0e38@popserver.sfu.ca>; from tmchow@sfu.ca on Thu, Jan 18, 2001 at 03:14:40PM -0800 References: <5.0.2.1.2.20010118130802.02bfc808@mail.brightmail.com> <3A676681.A7EB136B@mail.iowna.com> <5.0.2.1.2.20010118151323.02be0e38@popserver.sfu.ca>
next in thread | previous in thread | raw e-mail | index | archive | help
On Thu, Jan 18, 2001 at 03:14:40PM -0800, Trevin Chow wrote: > At 04:56 PM 1/18/2001 -0500, Bill Moran wrote: > > Also, what IP pool are you using on the internal interfaces? > > I'm using 192.168.x.x on the internal interfaces. > > >Post the full ruleset to the list. You have not tried to do something from your internal network. It looks like you are blocking all of the incoming traffic. Let's say one of your machines on internal net tries to connect to a machine on the Internet. The packet looks like it should get out. It would pass rule 1200 or 1300 coming in an interior interface. Then it would hit 300, get diverted and aliased, come back in, then pass 1100 and go out the exterior interface. On the way back... Trouble. The packet hits 300, gets diverted and aliased, and then gets dropped at rule 400 or 700. Try some traffic from the interior and see if the counts match. > Here's the full output of `ipfw show`: > > 00100 0 0 allow ip from any to any via lo0 > 00200 0 0 deny ip from any to 127.0.0.0/8 > 00300 26 1744 divert 8668 ip from any to any via dc0 > 00400 0 0 deny ip from 192.168.0.0/24 to any in recv dc0 > 00500 0 0 deny ip from 209.53.0.0/18 to any in recv fxp0 > 00600 0 0 deny ip from 209.53.0.0/18 to any in recv fxp1 > 00700 0 0 deny ip from 192.168.0.0/16 to any in recv dc0 > 00800 0 0 deny ip from 172.16.0.0/12 to any in recv dc0 > 00900 0 0 deny ip from 224.0.0.0/4 to any > 01000 0 0 deny ip from 10.0.0.0/8 to any in recv dc0 > 01100 12 984 allow ip from any to any out xmit dc0 > 01200 0 0 allow ip from any to any via fxp0 > 01300 0 0 allow ip from any to any via fxp1 > 01400 14 760 allow tcp from any to any in recv dc0 established > 01500 0 0 allow tcp from 142.58.101.25 to 209.53.60.139 2626 setup > 01600 0 0 allow tcp from 142.58.107.12 to 209.53.60.139 2626 setup > 01700 0 0 allow log logamount 100 tcp from 142.58.101.25 to > 209.53.60.139 2627 in recv dc0 setup > 01800 0 0 allow log logamount 100 tcp from 142.58.107.12 to > 209.53.60.139 2627 in recv dc0 setup > 01900 0 0 allow log logamount 100 tcp from 24.71.46.74 to 209.53.60.139 > 2627 in recv dc0 setup > 02000 0 0 allow log logamount 100 tcp from 209.53.63.29 to > 209.53.60.139 2627 in recv dc0 setup > 02100 0 0 allow log logamount 100 tcp from 24.113.38.121 to > 209.53.60.139 2627 in recv dc0 setup > 02200 0 0 allow tcp from any to 209.53.60.139 80 setup > 02300 0 0 allow tcp from any to 209.53.60.139 25 setup > 02400 0 0 allow tcp from 142.58.101.25 to 209.53.60.139 110 setup > 02500 0 0 allow tcp from 24.113.77.121 to 209.53.60.139 110 setup > 02600 0 0 allow udp from any 123 to 209.53.60.139 > 02700 0 0 allow udp from 209.53.60.139 to any 123 > 02800 0 0 allow udp from any to 209.53.60.139 53 > 02900 0 0 allow udp from 209.53.60.139 53 to any > 03000 0 0 allow tcp from any to 209.53.60.139 53 setup > 03100 0 0 allow tcp from any to 209.53.60.139 194 > 03200 0 0 allow udp from any to 209.53.60.139 194 > 03300 0 0 deny log logamount 100 tcp from any to any in recv dc0 setup > 03400 0 0 allow icmp from any to any via fxp0 > 03500 0 0 allow icmp from any to any via fxp1 > 03600 0 0 allow icmp from any to any in recv dc0 icmptype 0 > 03700 0 0 allow icmp from any to any out xmit dc0 icmptype 8 > 03800 0 0 allow udp from any to any 33434-33523 out xmit dc0 > 03900 0 0 allow icmp from any to any via dc0 icmptype 3,4,11,12 > 65532 0 0 deny udp from any to any > 65533 0 0 deny icmp from any to any > 65534 0 0 deny log logamount 100 ip from any to any > 65535 0 0 deny ip from any to any > > > > To Unsubscribe: send mail to majordomo@FreeBSD.org > with "unsubscribe freebsd-questions" in the body of the message -- Crist J. Clark cjclark@alum.mit.edu To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-questions" in the body of the message
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20010118205904.C66998>