Date: Mon, 15 Nov 2004 14:59:00 -0800 From: Aaron Nichols <adnichols@gmail.com> To: Andrew Smith <andsmith@andsmith.com> Cc: freebsd-questions@freebsd.org Subject: Re: ipf firewall questions Message-ID: <ac05538404111514594bf2cd57@mail.gmail.com> In-Reply-To: <001e01c4cb50$be9933b0$19c8a8c0@loriandsmith> References: <001e01c4cb50$be9933b0$19c8a8c0@loriandsmith>
next in thread | previous in thread | raw e-mail | index | archive | help
On Mon, 15 Nov 2004 15:21:47 -0500, Andrew Smith <andsmith@andsmith.com> wrote: > I'm using ipf as my firewall, and I can't figure out why OWA is being blocked going to 172.20.0.11. Below is the current config file which works. But if I removed the fourth line, my users can't access OWA externally. I would have thought the lines: pass out quick from 172.20.0.0/24 to any keep state and pass in quick from any to 172.20.0.0/24 would have superceded the line block out log proto tcp from any to any port = 80. > > Any suggestions would be helpful. > > Andrew > > -------------------------------------------------------------------- > > # > # Permit Outlook Web Access > # > pass in quick proto tcp from any to 172.20.0.11 port = 80 keep state > > # > # Allow All College Traffic > # > pass in quick from 10.0.0.0/8 to any > pass out quick from any to 10.0.0.0/8 > > # > # Permit all Network Critical Machines Access > # > pass out quick from 172.20.0.0/24 to any keep state > pass in quick from any to 172.20.0.0/24 > > # > # Permit all Network Teacher/Staff Computers Access > # > pass out quick from 172.20.1.0/24 to any keep state > pass in quick from any to 172.20.1.0/24 If you remove rule #4 - then there's nothing to allow response traffic that I can see (unless I'm missing something). I'd guess that if you remove #4 and add 'keep state' to #5 it'll work. Aaron
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?ac05538404111514594bf2cd57>