Skip site navigation (1)Skip section navigation (2)
Date:      Wed, 20 Dec 2000 18:49:37 +0100
From:      Rene de Vries <freebsd@canyon.demon.nl>
To:        freebsd-hackers@freebsd.org
Subject:   statefull packet filter together with natd question
Message-ID:  <20001220184937.A788@canyon.demon.nl>

next in thread | raw e-mail | index | archive | help
Hello,

Some time a go I posted the same question to freebsd-questions, but uptill now
I didn't get an answer.

Currently I'm trying to move towards a statefull packet filter. When testing
without nat all seems to work fine. But when I added natd (as the first
rule) packets that were natd-ed on their way out had their return traffic
blocked. The question is, what am I doing wrong?!?

I hope somebody can tell me how to solve this problem.

Rene

from my logs:

ipfw: Accept TCP 212.238.x.x:1026 x.x.x.x:23 out via isp0
ipfw: Deny TCP x.x.x.x:23 192.168.1.3:1026 in via isp0

ipfw rules:

/sbin/ipfw -f flush

/sbin/ipfw -q add divert natd all from any to any via isp0

/sbin/ipfw -q add allow all from any to any via lo0
/sbin/ipfw -q add allow all from any to any via dc0

/sbin/ipfw -q add check-state from any to any via isp0
/sbin/ipfw -q add deny log tcp from any to any established
/sbin/ipfw -q add allow all from any to any out via isp0 keep-state

/sbin/ipfw -q add deny log all from any to any

-- 
Rene de Vries                        http://www.tcja.nl mailto:rene@tcja.nl


To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-hackers" in the body of the message




Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20001220184937.A788>