From owner-freebsd-questions@FreeBSD.ORG Mon Nov 15 22:59:01 2004 Return-Path: Delivered-To: freebsd-questions@freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id 44C3716A4CE for ; Mon, 15 Nov 2004 22:59:01 +0000 (GMT) Received: from wproxy.gmail.com (wproxy.gmail.com [64.233.184.194]) by mx1.FreeBSD.org (Postfix) with ESMTP id DF28243D39 for ; Mon, 15 Nov 2004 22:59:00 +0000 (GMT) (envelope-from adnichols@gmail.com) Received: by wproxy.gmail.com with SMTP id 71so270902wra for ; Mon, 15 Nov 2004 14:59:00 -0800 (PST) DomainKey-Signature: a=rsa-sha1; q=dns; c=nofws; s=beta; d=gmail.com; h=received:message-id:date:from:reply-to:to:subject:cc:in-reply-to:mime-version:content-type:content-transfer-encoding:references; b=lI4E8lZv96rbVHzrc7TwkrN32EL42ucL0ZDsr28dqucw1vvRownVu/rBULHSRcd4YZ5W6OvpINT28I4v/5H7S8QxgZKHoSXWxn7FISHnENn+mlOvqyxNM3YCUs20AurwLoicH92TdOQuF1wmCymdfj43pIWiZYgkjTWkNlidCgk= Received: by 10.54.38.45 with SMTP id l45mr422572wrl; Mon, 15 Nov 2004 14:59:00 -0800 (PST) Received: by 10.54.35.52 with HTTP; Mon, 15 Nov 2004 14:59:00 -0800 (PST) Message-ID: Date: Mon, 15 Nov 2004 14:59:00 -0800 From: Aaron Nichols To: Andrew Smith In-Reply-To: <001e01c4cb50$be9933b0$19c8a8c0@loriandsmith> Mime-Version: 1.0 Content-Type: text/plain; charset=US-ASCII Content-Transfer-Encoding: 7bit References: <001e01c4cb50$be9933b0$19c8a8c0@loriandsmith> cc: freebsd-questions@freebsd.org Subject: Re: ipf firewall questions X-BeenThere: freebsd-questions@freebsd.org X-Mailman-Version: 2.1.1 Precedence: list Reply-To: Aaron Nichols List-Id: User questions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 15 Nov 2004 22:59:01 -0000 On Mon, 15 Nov 2004 15:21:47 -0500, Andrew Smith wrote: > I'm using ipf as my firewall, and I can't figure out why OWA is being blocked going to 172.20.0.11. Below is the current config file which works. But if I removed the fourth line, my users can't access OWA externally. I would have thought the lines: pass out quick from 172.20.0.0/24 to any keep state and pass in quick from any to 172.20.0.0/24 would have superceded the line block out log proto tcp from any to any port = 80. > > Any suggestions would be helpful. > > Andrew > > -------------------------------------------------------------------- > > # > # Permit Outlook Web Access > # > pass in quick proto tcp from any to 172.20.0.11 port = 80 keep state > > # > # Allow All College Traffic > # > pass in quick from 10.0.0.0/8 to any > pass out quick from any to 10.0.0.0/8 > > # > # Permit all Network Critical Machines Access > # > pass out quick from 172.20.0.0/24 to any keep state > pass in quick from any to 172.20.0.0/24 > > # > # Permit all Network Teacher/Staff Computers Access > # > pass out quick from 172.20.1.0/24 to any keep state > pass in quick from any to 172.20.1.0/24 If you remove rule #4 - then there's nothing to allow response traffic that I can see (unless I'm missing something). I'd guess that if you remove #4 and add 'keep state' to #5 it'll work. Aaron