Date: Wed, 28 Apr 1999 18:27:27 -0700 From: Christoff Snijders <hjcs@home.com> To: Guy Helmer <ghelmer@scl.ameslab.gov> Cc: freebsd-questions@FreeBSD.ORG Subject: Re: ipfw rules Message-ID: <3727B56C.2D8D0ED1@home.com> References: <Pine.SGI.4.10.9904281932230.4039-100000@demios.scl.ameslab.gov>
next in thread | previous in thread | raw e-mail | index | archive | help
Guy Helmer wrote:
>
> On Wed, 28 Apr 1999, Christoff Snijders wrote:
[snip]
> > ...
> > # divert traffic to natd (I added this)
> > /sbin/ipfw add divert natd all from any to any via ed2
>
> Hmm, isn't there a divert rule at the beginning of /etc/rc.firewall?
It doesn't look like it in 2.2.5-RELEASE.
> > ...
> > # Stop RFC1918 nets on the outside interface
> > $fwcmd add deny all from 192.168.0.0:255.255.0.0 to any via ${oif}
> > $fwcmd add deny all from 172.16.0.0:255.240.0.0 to any via ${oif}
> > $fwcmd add deny all from 10.0.0.0:255.0.0.0 to any via ${oif}
>
> I've replaced those three rules with these six rules on my 2.2.8 firewall:
>
> # Stop RFC1918 nets on the outside interface
> $fwcmd add deny all from 192.168.0.0:255.255.0.0 to any in via ${oif}
> $fwcmd add deny all from any to 192.168.0.0:255.255.0.0 out via ${oif}
> $fwcmd add deny all from 172.16.0.0:255.240.0.0 to any in via ${oif}
> $fwcmd add deny all from any to 172.16.0.0:255.240.0.0 out via ${oif}
> $fwcmd add deny all from 10.0.0.0:255.0.0.0 to any in via ${oif}
> $fwcmd add deny all from any to 10.0.0.0:255.0.0.0 out via ${oif}
>
> Hope this helps,
Thanks for the info. I actually tried this (but I tried it now again,
to be sure) when I found one of your postings to this mailing list in
the archives. It seems that if I remove the rule
ipfw 65000 allow ip from any to any
my internal network can't see the Internet (even with the changes you
suggest). I would ideally like to be able to remove rule 65000, and have
explicit rules to allow traffic in, but then again, I don't really know
what I'm doing here, and maybe what I've got is okay, given the deny
rules that appear higher up in the list. :-)
Thanks again,
Christoff Snijders
To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-questions" in the body of the message
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?3727B56C.2D8D0ED1>