Date: Mon, 27 Dec 1999 23:44:27 -0500 From: John <papalia@udel.edu> To: freebsd-questions@freebsd.org Subject: IPFW Message-ID: <4.1.19991227224118.009e68e0@mail.udel.edu>
next in thread | raw e-mail | index | archive | help
Hi all,
I was just tooling around with the rules for configuring a "simple" config
instead of an "open" config, both to learn, and to ultimately achieve the
simple config. In messing around though, I came up with a question that
I'm not sure about.
Network configuration is:
* FreeBSD gateway maintaining an assigned Outside IP
* Same box maintains an Inside IP on 192.168.x.x subnet
* All inside boxes assigned 192.168.x.x IP's
For example, if I want to allow SSH connections only *to* the FreeBSD box,
but I want both the FreeBSD and the internal boxes to be able to generate
outgoing SSH sessions in the outside world, is the following enough?:
# Allow all traffic from inside out
$fwcmd add pass all from ${iip} to ${inet}:${imask}
$fwcmd add pass all from ${inet}:${imask} to ${iip}
# Allow access to SSH
$fwcmd add pass any from any to ${oip} 22 setup
$fwcmd add pass any from ${oip} to any 22 setup
# Allow all established connections to pass
$fwcmd add pass tcp from any to any established
Also, if I wanted users on the inside network to be able to access external
hosts for popmail, but wanted to have popmail disabled on the freebsd
server, would the following solve the problem, or would it cause a security
hole?:
$fwcmd add pass any from ${inet}:${imask} to any 110 via ${oif} setup
Thanks in advance!!!
Best,
John Papalia
To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-questions" in the body of the message
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?4.1.19991227224118.009e68e0>