Date: Wed, 07 Feb 2007 00:22:22 +0100 From: Erik Norgaard <norgaard@locolomo.org> To: Erik Norgaard <norgaard@locolomo.org> Cc: FreeBSD Questions <questions@freebsd.org> Subject: Solved: Negation in tables for packet filter Message-ID: <45C90DAE.8070104@locolomo.org> In-Reply-To: <45BCAC1F.80701@locolomo.org> References: <45BCAC1F.80701@locolomo.org>
next in thread | previous in thread | raw e-mail | index | archive | help
[-- Attachment #1 --]
Erik Norgaard wrote:
> I want to create two tables in my packet filter, the first should match
> any valid public ip, so I created a table negating anything reserved:
>
> table <internet> const { !0/8 !10/8 !127/8 !169.254/16 !172.16/12 \
> !192.0.2/24 !192.168/16 !198.18/15 !224/4 !240/4 }
Of course, I could do something different here, defining a table for
<local> networks and negate it. The rest should be caught by the
filtering rules anyway to block non-routable packets.
> I have three tables with
> different registered hosts with different access levels, I want to
> redirect unknown hosts to a page explaining what to do to get registered,
>
> rdr on $wlan_if proto tcp from { $wlan_net !<super> !<users> !<free> } \
> to <internet> port http -> 127.0.0.1 port 8000
This one is solved with:
no rdr on $wlan_if proto tcp from { <super> <users> <free> } \
to <internet> port http
rdr on $wlan_if proto tcp from $wlan_net to !<local> \
port http -> 127.0.0.1 port 8000
However, it would be nice to know if the documentation is incorrect, or
there is a difference in how negation is treated in nat and filter
respectively.
Thanks, Erik
--
Ph: +34.666334818 web: http://www.locolomo.org
[-- Attachment #2 --]
0 *H
01 0 + 0 *H
0p0XET+0
*H
011 0 UDK1 0
U
TDC10U TDC OCES CA0
061115083154Z
081115090154Z0u1 0 UDK1)0'U
Ingen organisatorisk tilknytning1;0U
Erik Nrgaard0#U PID:9802-2002-2-54436976931500
*H
0 WR&5ʄ8 #S^fOパBrIsPBc! >r&8hl3?\.UGB\E 3Q!1MrwP*02\|\&s{b'`1&1 00U 0+U $0"20061115083154Z20081115090154Z07U .0*0&
*P)00/+#http://www.certifikat.dk/repository0+00
TDC0For anvendelse af certifikatet glder OCES vilkr, CPS og OCES CP, der kan hentes fra www.certifikat.dk/repository. Bemrk, at TDC efter vilkrene har et begrnset ansvar ift. professionelle parter.0A+50301+0%http://ocsp.certifikat.dk/ocsp/status0 U 0norgaard@locolomo.org0U }0{0KIGE0C1 0 UDK1 0
U
TDC10U TDC OCES CA10UCRL15570,*(&http://crl.oces.certifikat.dk/oces.crl0 U #0`Vd~'g PKs;0 U ~kG 'f+Q{m&0 U 0 0 *H}A 0
V7.10
*H
OJ'|)%Ҋi`1
^nE
jJwKӼB 65V SǶw`y$L =YXʷ/\E~,PW$AB\ 汎 ͙
7%$ N-ށ"/Ww#ғkMA6S0dD~\w*z Pq`# 69;pS6 뛨3:9s_.'³Q$S0yAƶlqfLi0p0XET+0
*H
011 0 UDK1 0
U
TDC10U TDC OCES CA0
061115083154Z
081115090154Z0u1 0 UDK1)0'U
Ingen organisatorisk tilknytning1;0U
Erik Nrgaard0#U PID:9802-2002-2-54436976931500
*H
0 WR&5ʄ8 #S^fOパBrIsPBc! >r&8hl3?\.UGB\E 3Q!1MrwP*02\|\&s{b'`1&1 00U 0+U $0"20061115083154Z20081115090154Z07U .0*0&
*P)00/+#http://www.certifikat.dk/repository0+00
TDC0For anvendelse af certifikatet glder OCES vilkr, CPS og OCES CP, der kan hentes fra www.certifikat.dk/repository. Bemrk, at TDC efter vilkrene har et begrnset ansvar ift. professionelle parter.0A+50301+0%http://ocsp.certifikat.dk/ocsp/status0 U 0norgaard@locolomo.org0U }0{0KIGE0C1 0 UDK1 0
U
TDC10U TDC OCES CA10UCRL15570,*(&http://crl.oces.certifikat.dk/oces.crl0 U #0`Vd~'g PKs;0 U ~kG 'f+Q{m&0 U 0 0 *H}A 0
V7.10
*H
OJ'|)%Ҋi`1
^nE
jJwKӼB 65V SǶw`y$L =YXʷ/\E~,PW$AB\ 汎 ͙
7%$ N-ށ"/Ww#ғkMA6S0dD~\w*z Pq`# 69;pS6 뛨3:9s_.'³Q$S0yAƶlqfLi1*0&09011 0 UDK1 0
U
TDC10U TDC OCES CAET+0 + G0 *H
1 *H
0 *H
1
070206232222Z0# *H
1]J6 w!>JdD ;0H +71;09011 0 UDK1 0
U
TDC10U TDC OCES CAET+0J *H
1;9011 0 UDK1 0
U
TDC10U TDC OCES CAET+0R *H
1E0C0
*H
0*H
0
*H
@0+0
*H
(0
*H
N K-nG
@'#?GUbdbX<x8L5m/Êhe+
߮W sAw:-\mX: mox ipʾ]?@^^
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?45C90DAE.8070104>