Date: Tue, 25 Jul 2000 02:23:14 -0500 From: Stephen Montgomery-Smith <stephen@math.missouri.edu> To: cjclark@alum.mit.edu Cc: freebsd-security@FreeBSD.ORG Subject: Re: Problems with natd and simple firewall Message-ID: <397D4062.4A1FFFE2@math.missouri.edu> References: <397C8F30.8DFCE0E9@math.missouri.edu> <20000724225053.B258@pool0653.cvx20-bradley.dialup.e>
next in thread | previous in thread | raw e-mail | index | archive | help
"Crist J. Clark" wrote:
>
> Why not just block the RFC1918 addresses on the outer interface
> _before_ the divert rule?
>
> # Stop RFC1918 nets on the outside interface
> ...........
> ${fwcmd} add deny all from any to 192.168.0.0/16 via ${oif}
>
> $fwcmd add divert natd all from any to any via ${natd_interface}
>
> Seems simple enough? No downside I can see.
Yes, I had the same idea over dinner. Trouble is, it doesn't work.
I tried it.
--
Stephen Montgomery-Smith
Department of Mathematics, University of Missouri, Columbia, MO 65211
Phone 573-882-4540, fax 573-882-1869
http://www.math.missouri.edu/~stephen stephen@math.missouri.edu
To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-security" in the body of the message
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?397D4062.4A1FFFE2>