From owner-freebsd-hackers Wed Dec 20 9:49:57 2000 From owner-freebsd-hackers@FreeBSD.ORG Wed Dec 20 09:49:55 2000 Return-Path: Delivered-To: freebsd-hackers@freebsd.org Received: from post.mail.nl.demon.net (post-10.mail.nl.demon.net [194.159.73.20]) by hub.freebsd.org (Postfix) with ESMTP id C9B5037B400 for ; Wed, 20 Dec 2000 09:49:54 -0800 (PST) Received: from [212.238.15.212] (helo=grand.canyon.demon.nl) by post.mail.nl.demon.net with smtp (Exim 3.14 #2) id 148nN6-00059a-00 for freebsd-hackers@freebsd.org; Wed, 20 Dec 2000 17:49:49 +0000 Received: by grand.canyon.demon.nl (Postfix, from userid 1000) id 0A59B206A; Wed, 20 Dec 2000 18:49:37 +0100 (CET) Date: Wed, 20 Dec 2000 18:49:37 +0100 From: Rene de Vries To: freebsd-hackers@freebsd.org Subject: statefull packet filter together with natd question Message-ID: <20001220184937.A788@canyon.demon.nl> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline User-Agent: Mutt/1.2.5i Sender: rene@canyon.demon.nl Sender: owner-freebsd-hackers@FreeBSD.ORG Precedence: bulk X-Loop: FreeBSD.ORG Hello, Some time a go I posted the same question to freebsd-questions, but uptill now I didn't get an answer. Currently I'm trying to move towards a statefull packet filter. When testing without nat all seems to work fine. But when I added natd (as the first rule) packets that were natd-ed on their way out had their return traffic blocked. The question is, what am I doing wrong?!? I hope somebody can tell me how to solve this problem. Rene from my logs: ipfw: Accept TCP 212.238.x.x:1026 x.x.x.x:23 out via isp0 ipfw: Deny TCP x.x.x.x:23 192.168.1.3:1026 in via isp0 ipfw rules: /sbin/ipfw -f flush /sbin/ipfw -q add divert natd all from any to any via isp0 /sbin/ipfw -q add allow all from any to any via lo0 /sbin/ipfw -q add allow all from any to any via dc0 /sbin/ipfw -q add check-state from any to any via isp0 /sbin/ipfw -q add deny log tcp from any to any established /sbin/ipfw -q add allow all from any to any out via isp0 keep-state /sbin/ipfw -q add deny log all from any to any -- Rene de Vries http://www.tcja.nl mailto:rene@tcja.nl To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-hackers" in the body of the message