From owner-freebsd-questions@FreeBSD.ORG  Sun Nov 28 01:01:09 2004
Return-Path: <owner-freebsd-questions@FreeBSD.ORG>
Delivered-To: freebsd-questions@freebsd.org
Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125])
	by hub.freebsd.org (Postfix) with ESMTP id 7181816A4CE
	for <freebsd-questions@freebsd.org>;
	Sun, 28 Nov 2004 01:01:09 +0000 (GMT)
Received: from ns1.tiadon.com (SMTP.tiadon.com [69.27.132.161])
	by mx1.FreeBSD.org (Postfix) with ESMTP id B44FF43D64
	for <freebsd-questions@freebsd.org>;
	Sun, 28 Nov 2004 01:01:04 +0000 (GMT)	(envelope-from kdk@daleco.biz)
Received: from [69.27.131.0] ([69.27.131.0]) by ns1.tiadon.com with Microsoft
	SMTPSVC(6.0.3790.211);	 Sat, 27 Nov 2004 18:57:57 -0600
Message-ID: <41A9235D.7050806@daleco.biz>
Date: Sat, 27 Nov 2004 19:01:17 -0600
From: "Kevin D. Kinsey, DaleCo, S.P." <kdk@daleco.biz>
User-Agent: Mozilla/5.0 (X11; U; FreeBSD i386; en-US; rv:1.7.2) Gecko/20041023
X-Accept-Language: en-us, en
MIME-Version: 1.0
To: Jonathon McKitrick <jcm@FreeBSD-uk.eu.org>
References: <20041127215612.GA86416@dogma.freebsd-uk.eu.org>
In-Reply-To: <20041127215612.GA86416@dogma.freebsd-uk.eu.org>
Content-Type: text/plain; charset=us-ascii; format=flowed
Content-Transfer-Encoding: 7bit
X-OriginalArrivalTime: 28 Nov 2004 00:57:57.0715 (UTC)
	FILETIME=[4CF83230:01C4D4E5]
cc: freebsd-questions@freebsd.org
Subject: Re: Is this a hole in my firewall?
X-BeenThere: freebsd-questions@freebsd.org
X-Mailman-Version: 2.1.1
Precedence: list
List-Id: User questions <freebsd-questions.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-questions>,
	<mailto:freebsd-questions-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-questions>
List-Post: <mailto:freebsd-questions@freebsd.org>
List-Help: <mailto:freebsd-questions-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-questions>,
	<mailto:freebsd-questions-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Sun, 28 Nov 2004 01:01:09 -0000

Jonathon McKitrick wrote:

>Here are my rules:
>
>root@neptune:~# ipfw show
>00100 0   0 check-state
>00200 2 144 allow ip from me to any keep-state out xmit tun0
>00300 0   0 allow ip from any to any keep-state out xmit tun0
>00400 0   0 deny tcp from any to any in recv tun0 established
>00500 0   0 allow ip from any to any via vr0
>00600 0   0 allow ip from any to any via lo0
>00700 0   0 deny ip from any to 127.0.0.0/8
>00800 0   0 deny ip from 127.0.0.0/8 to any
>00900 0   0 allow tcp from any to me 22 keep-state in recv vr0 setup
>01000 0   0 allow icmp from any to any via tun0 icmptype 0,3,8,11,12
>01100 0   0 deny log logamount 100 ip from any to any
>65535 0   0 deny ip from any to any
>
>I added rule 300 so that my laptop on my wireless network can connect, ping,
>and get DNS and DHCP.  Is there a better way to specify this?
>
>jm
>  
>

Well, maybe; is the laptop's IP assigned statically or
dynamically?

If static, I suppose

"allow ip from lap.top.id.addr to any keep-state out xmit tun0"

would be the thing. You can also specify the network:

"allow ip from any 192.168.0/24 to any keep-state out via tun0".

HTH,