Date: Sun, 7 Feb 1999 13:43:25 +0300 (MSK) From: Danil Shebunin <daktaklakpak@mtu-net.ru> To: freebsd-questions@FreeBSD.ORG, freebsd-hackers@FreeBSD.ORG Subject: user ppp packet filtering & ipfw Message-ID: <Pine.BSF.4.05.9902051511020.346-100000@free-bsd.space>
next in thread | raw e-mail | index | archive | help
Hi! Excuse me about my poor English. I have a question about ppp & ipfw. I connect to my ISP with user ppp. The -alias option is turned on bescause my internal network have an address 192.168.1.x, and ISP assigns a dynamic IPaddr to me. The gateway computer, which also used as dialout server, have address 192.168.1.1 I need to disable any connections to Telnet and port 3000 of gateway from Internet (but enable to connect to these ports from internal network). Also I need to allow/disallow computers of my internal network to connect to Internet via gate. How can I achieve all this? P.S. I have read man 8 ppp and change ppp.conf file. Below I provide a cut from this file. It seems to work. Do I go a right way? ---8<--- #I want to disallow comp 192.168.1.2 to use Internet connection set filter in 0 deny 0/0 192.168.1.2/32 set filter out 0 deny 192.168.1.2/32 0/0 set filter in 1 deny tcp src eq telnet estab set filter out 1 permit tcp dst eq telnet set filter in 2 deny tcp dst eq 3000 set filter in 3 permit tcp src eq 21 estab set filter out 3 permit tcp dst eq 21 set filter in 4 permit tcp src eq 20 dst gt 1023 set filter out 4 permit tcp dst eq 20 set filter in 5 permit tcp src eq 80 estab set filter out 5 permit tcp dst eq 80 set filter in 6 permit udp src eq 53 set filter out 6 permit udp dst eq 53 set filter in 7 permit icmp set filter out 7 permit icmp set filter in 8 permit udp dst gt 33433 set filter out 8 permit udp dst gt 33433 set server +3000 internet --->8--- When the rules calculated, if packet is come from outside (Internet): before IP packet de-aliasing is performed, or after the packet appears in internal network? And what about packet going from inside to outside? Maybe the point is to use ppp packet filtering for external network and ipfw - for internal? Or maybe I can use ipfw for both networks. In this case, how can I specify dynamic IPaddr in ipfw rules. P.P.S. PLEASE, PLEASE, PLEASE Reply to my e-mail also - I do not subscribed on this mailing lists. Thanks, as long as you answer. -- ===---===---===---===---===---=== Have a nice CONNECT! Dan (daktaklakpak@public.mtu.ru) ===---===---===---===---===---=== To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-hackers" in the body of the message
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?Pine.BSF.4.05.9902051511020.346-100000>