From owner-freebsd-questions Thu Apr 25 12:24:26 2002 Delivered-To: freebsd-questions@freebsd.org Received: from infinity.aesredfish.net (ns1.aesredfish.net [65.168.0.12]) by hub.freebsd.org (Postfix) with ESMTP id A9C4E37B404 for ; Thu, 25 Apr 2002 12:24:17 -0700 (PDT) Received: from potentialtech.com (mhope-dhcp-65-168-1-181.dashfast.com [65.168.1.181]) by infinity.aesredfish.net (8.11.6/8.11.0) with ESMTP id g3PJNxm19426; Thu, 25 Apr 2002 15:23:59 -0400 Message-ID: <3CC85901.7020308@potentialtech.com> Date: Thu, 25 Apr 2002 15:29:05 -0400 From: Bill Moran Organization: Potential Technologies User-Agent: Mozilla/5.0 (X11; U; FreeBSD i386; en-US; rv:0.9.3) Gecko/20010914 X-Accept-Language: en-us MIME-Version: 1.0 To: Carolyn Longfoot Cc: freebsd-questions@freebsd.org Subject: Re: rc.firewall problems References: Content-Type: text/plain; charset=us-ascii; format=flowed Content-Transfer-Encoding: 7bit Sender: owner-freebsd-questions@FreeBSD.ORG Precedence: bulk List-ID: List-Archive: (Web Archive) List-Help: (List Instructions) List-Subscribe: List-Unsubscribe: X-Loop: FreeBSD.ORG Carolyn Longfoot wrote: > If anybody could point me to what I'm missing I'd appreciate it. I am > running NAT and to get anything to work I added the rows marked with === > (not marked in the actual file of course). That feels pretty wrong and > I'm especially puzzled why BOTH are needed, i can see that 'sh > rc.firewall' executed the nat rule further down so why would the first > one make a difference? Do you have the proper settings in /etc/rc.conf to set the variables for natd_interface correctly? Reboot your system and then do ipfw show > somefile.txt and compare the contents of that file with what you think it should be doing > > Cheers, > > Caro > > # set these to your outside interface network and netmask and ip > oif="rl0" > onet="1.1.1.0" > omask="255.255.255.252" > oip="1.1.1.1" > > # set these to your inside interface network and netmask and ip > iif="rl1" > inet="10.0.0.0" > imask="255.255.255.0" > iip="10.0.0.1" > > === ${fwcmd} add divert natd all from any to any via ${oif} > === ${fwcmd} add pass all from any to any > > # Stop spoofing > ${fwcmd} add deny all from ${inet}:${imask} to any in via ${oif} > ${fwcmd} add deny all from ${onet}:${omask} to any in via ${iif} > > # Stop RFC1918 nets on the outside interface > ${fwcmd} add deny all from any to 10.0.0.0/8 via ${oif} > ${fwcmd} add deny all from any to 172.16.0.0/12 via ${oif} > ${fwcmd} add deny all from any to 192.168.0.0/16 via ${oif} > > # Stop draft-manning-dsua-03.txt (1 May 2000) nets (includes > RESERVED-1, > # DHCP auto-configuration, NET-TEST, MULTICAST (class D), and class E) > # on the outside interface > ${fwcmd} add deny all from any to 0.0.0.0/8 via ${oif} > ${fwcmd} add deny all from any to 169.254.0.0/16 via ${oif} > ${fwcmd} add deny all from any to 192.0.2.0/24 via ${oif} > ${fwcmd} add deny all from any to 224.0.0.0/4 via ${oif} > ${fwcmd} add deny all from any to 240.0.0.0/4 via ${oif} > > # Network Address Translation. This rule is placed here deliberately > # so that it does not interfere with the surrounding address-checking > # rules. If for example one of your internal LAN machines had its IP > # address set to 192.0.2.1 then an incoming packet for it after being > # translated by natd(8) would match the `deny' rule above. Similarly > # an outgoing packet originated from it before being translated would > # match the `deny' rule below. > case ${natd_enable} in > [Yy][Ee][Ss]) > if [ -n "${natd_interface}" ]; then > ${fwcmd} add divert natd all from any to any via > ${natd_interface} > fi > ;; > esac > > # Stop RFC1918 nets on the outside interface > ${fwcmd} add deny all from 10.0.0.0/8 to any via ${oif} > ${fwcmd} add deny all from 172.16.0.0/12 to any via ${oif} > ${fwcmd} add deny all from 192.168.0.0/16 to any via ${oif} > > # Stop draft-manning-dsua-03.txt (1 May 2000) nets (includes > RESERVED-1, > # DHCP auto-configuration, NET-TEST, MULTICAST (class D), and class E) > # on the outside interface > ${fwcmd} add deny all from 0.0.0.0/8 to any via ${oif} > ${fwcmd} add deny all from 169.254.0.0/16 to any via ${oif} > ${fwcmd} add deny all from 192.0.2.0/24 to any via ${oif} > ${fwcmd} add deny all from 224.0.0.0/4 to any via ${oif} > ${fwcmd} add deny all from 240.0.0.0/4 to any via ${oif} > > ${fwcmd} add pass all from any to any via ${iif} > ${fwcmd} add pass all from ${onet}:${omask} to any out via ${oif} > > # Allow TCP through if setup succeeded > ${fwcmd} add pass tcp from any to any established > > # Allow IP fragments to pass through > ${fwcmd} add pass all from any to any frag > > # Allow setup of incoming email > ${fwcmd} add pass tcp from any to ${oip} 25 setup > > # Allow access to our DNS > ${fwcmd} add pass tcp from any to ${oip} 53 setup > ${fwcmd} add pass udp from any to ${oip} 53 > ${fwcmd} add pass udp from ${oip} 53 to any > > # Allow access to our WWW > ${fwcmd} add pass tcp from any to ${oip} 80 setup > > # Reject&Log all setup of incoming connections from the outside > ${fwcmd} add deny log tcp from any to any in via ${oif} setup > > # Allow setup of any other TCP connection > ${fwcmd} add pass tcp from any to any setup > > # Allow DNS queries out in the world > ${fwcmd} add pass udp from any 53 to ${oip} > ${fwcmd} add pass udp from ${oip} to any 53 > > # Allow NTP queries out in the world > ${fwcmd} add pass udp from any 123 to ${oip} > ${fwcmd} add pass udp from ${oip} to any 123 > > # Everything else is denied by default, unless the > # IPFIREWALL_DEFAULT_TO_ACCEPT option is set in your kernel > # config file. > ;; > > > _________________________________________________________________ > Send and receive Hotmail on your mobile device: http://mobile.msn.com > > > To Unsubscribe: send mail to majordomo@FreeBSD.org > with "unsubscribe freebsd-questions" in the body of the message > > -- Bill Moran Potential Technology http://www.potentialtech.com To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-questions" in the body of the message