From owner-freebsd-ipfw@FreeBSD.ORG Fri Oct 21 14:36:28 2005 Return-Path: X-Original-To: freebsd-ipfw@freebsd.org Delivered-To: freebsd-ipfw@freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id DD03D16A41F for ; Fri, 21 Oct 2005 14:36:27 +0000 (GMT) (envelope-from daemon@foxchat.net) Received: from foxsurfer.com (dns1.foxsurfer.com [205.134.229.66]) by mx1.FreeBSD.org (Postfix) with ESMTP id 94CCE43D45 for ; Fri, 21 Oct 2005 14:36:27 +0000 (GMT) (envelope-from daemon@foxchat.net) Received: from [24.172.9.74] (zapper@rrcs-24-172-9-74.midsouth.biz.rr.com [24.172.9.74]) by foxsurfer.com (8.13.3/8.13.3) with ESMTP id j9LEaL0T017917 for ; Fri, 21 Oct 2005 07:36:22 -0700 (PDT) (envelope-from daemon@foxchat.net) Message-ID: <4358FCE7.5040803@foxchat.net> Date: Fri, 21 Oct 2005 10:36:23 -0400 From: Daemon User-Agent: Mozilla Thunderbird 1.0.7 (X11/20050930) X-Accept-Language: en-us, en MIME-Version: 1.0 To: freebsd-ipfw@freebsd.org CC: freebsd-ipfw@freebsd.org References: <435849B9.8040509@foxchat.net> <4358899F.1090505@roamingsolutions.net> In-Reply-To: <4358899F.1090505@roamingsolutions.net> Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: 7bit X-Spam-Status: No, score=-5.9 required=9.5 tests=ALL_TRUSTED,BAYES_00 autolearn=failed version=3.0.4 X-Spam-Checker-Version: SpamAssassin 3.0.4 (2005-06-05) on FoxSurfer.Com Subject: Re: ipfw firewall help X-BeenThere: freebsd-ipfw@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: IPFW Technical Discussions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 21 Oct 2005 14:36:28 -0000 Great!. Thanks. One possibly stupid question. What is the "Deny Spoof"? Is that like; # Stop spoofing of your internal network range # ${fwcmd} add deny ip from ${iif} to any in via ${oif} # Stop spoofing from inside your private ip range # ${fwcmd} add deny ip from not ${iif} to any in via ${iif} G Bryant wrote: > Hi, > I found my rules worked best in this order: > (You will need to correct the syntax - just typed up the order for you > quickly) > > Deny spoofed > Allow localhost > Allow all from any to any via $iif > divert natd all from any to any in via $oif > #insert bandwidth shaping rules > skipto 5000 all from $iip to any out via $oif > #allow all from any to me in via $oif # if you want to receive traffic > from internet to this box. Your decision if you need it. > deny all from any to any out > allow all from any to $iip in via $oif > #allow all from me to any out via $oif # traffic from this box out to > the internet. Your decision if you need it. > deny all from any to any in > 5000 nat all from any to any out via $oif > allow all from any to any out > > This is a very "open" set of rules - your choice. > Hope this helps. > Regards, Graham > > > Daemon wrote: > >> I'm trying to build a firewall from scratch using man ipfw and what I >> can find on the net. I'm doing bandwidth shaping and I'm not quite sure >> where it goes as far as rule numbers. From what I can see, it matters >> and I'd like to do it right. I'm using an OPEN firewall with NATD >> because I'm on cable broadband with a static IP. Here is what I have. >> >> 00010 52 2446 pipe 1 ip from 172.16.140.0/24 to any xmit re0 >> 00020 0 0 pipe 2 ip from any to 172.16.140.0/24 recv re0 >> 00050 274 24955 divert 8668 ip from any to any via re0 >> 00100 50 5642 allow ip from any to any via lo0 >> 00200 0 0 deny ip from any to 127.0.0.0/8 >> 00300 0 0 deny ip from 127.0.0.0/8 to any >> 65535 4658 547779 allow ip from any to any >> >> The actual rule set for the bandwidth shaping is: >> >> # Traffic Shaping. >> # oif="re0" # ${oif} Public Interface. >> # iif="re1" # ${iif} Internal nic. >> # iip="172.16.140.0/24" # ${iip} >> >> ${fwcmd} add 10 pipe 1 all from ${iip} to any xmit ${oif} >> ${fwcmd} pipe 1 config mask src-ip 0xffffff00 bw 35Kbits/s queue 40Kbytes >> >> ${fwcmd} add 20 pipe 2 all from any to ${iip} recv ${oif} >> ${fwcmd} pipe 2 config mask dst-ip 0xffffff00 bw 4000Kbits/s queue >> 40Kbytes >> >> I've found lots of stuff on "how" to set it up but I can't seem to find >> anything on where the rules go. Any help would be greatly appreciated. >> >> Regards, >> >> Mark >> _______________________________________________ >> freebsd-ipfw@freebsd.org mailing list >> http://lists.freebsd.org/mailman/listinfo/freebsd-ipfw >> To unsubscribe, send any mail to "freebsd-ipfw-unsubscribe@freebsd.org" >> >> >> >> > > _______________________________________________ > freebsd-ipfw@freebsd.org mailing list > http://lists.freebsd.org/mailman/listinfo/freebsd-ipfw > To unsubscribe, send any mail to "freebsd-ipfw-unsubscribe@freebsd.org" >