From owner-freebsd-questions  Wed Apr 28 18:21:51 1999
Delivered-To: freebsd-questions@freebsd.org
Received: from mail.rdc1.bc.home.com (ha1.rdc1.bc.wave.home.com [24.2.10.66])
	by hub.freebsd.org (Postfix) with ESMTP id 9049D14D94
	for <freebsd-questions@FreeBSD.ORG>; Wed, 28 Apr 1999 18:21:49 -0700 (PDT)
	(envelope-from hjcs@home.com)
Received: from home.com ([24.113.114.44]) by mail.rdc1.bc.home.com
          (InterMail v4.00.03 201-229-104) with ESMTP
          id <19990429012149.BRJY24551.mail.rdc1.bc.home.com@home.com>;
          Wed, 28 Apr 1999 18:21:49 -0700
Message-ID: <3727B56C.2D8D0ED1@home.com>
Date: Wed, 28 Apr 1999 18:27:27 -0700
From: Christoff Snijders <hjcs@home.com>
X-Mailer: Mozilla 4.51 (Macintosh; I; PPC)
X-Accept-Language: en
MIME-Version: 1.0
To: Guy Helmer <ghelmer@scl.ameslab.gov>
Cc: freebsd-questions@FreeBSD.ORG
Subject: Re: ipfw rules
References: <Pine.SGI.4.10.9904281932230.4039-100000@demios.scl.ameslab.gov>
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit
Sender: owner-freebsd-questions@FreeBSD.ORG
Precedence: bulk
X-Loop: FreeBSD.ORG

Guy Helmer wrote:
> 
> On Wed, 28 Apr 1999, Christoff Snijders wrote:
 
[snip]
 
> > ...
> >     # divert traffic to natd (I added this)
> >     /sbin/ipfw add divert natd all from any to any via ed2
> 
> Hmm, isn't there a divert rule at the beginning of /etc/rc.firewall?


It doesn't look like it in 2.2.5-RELEASE.

 
> > ...
> >     # Stop RFC1918 nets on the outside interface
> >     $fwcmd add deny all from 192.168.0.0:255.255.0.0 to any via ${oif}
> >     $fwcmd add deny all from 172.16.0.0:255.240.0.0 to any via ${oif}
> >     $fwcmd add deny all from 10.0.0.0:255.0.0.0 to any via ${oif}
> 
> I've replaced those three rules with these six rules on my 2.2.8 firewall:
> 
>     # Stop RFC1918 nets on the outside interface
>     $fwcmd add deny all from 192.168.0.0:255.255.0.0 to any in via ${oif}
>     $fwcmd add deny all from any to 192.168.0.0:255.255.0.0 out via ${oif}
>     $fwcmd add deny all from 172.16.0.0:255.240.0.0 to any in via ${oif}
>     $fwcmd add deny all from any to 172.16.0.0:255.240.0.0 out via ${oif}
>     $fwcmd add deny all from 10.0.0.0:255.0.0.0 to any in via ${oif}
>     $fwcmd add deny all from any to 10.0.0.0:255.0.0.0 out via ${oif}
> 
> Hope this helps,


Thanks for the info.  I actually tried this (but I tried it now again,
to be sure) when I found one of your postings to this mailing list in
the archives. It seems that if I remove the rule

ipfw 65000 allow ip from any to any

my internal network can't see the Internet (even with the changes you
suggest). I would ideally like to be able to remove rule 65000, and have
explicit rules to allow traffic in, but then again, I don't really know
what I'm doing here, and maybe what I've got is okay, given the deny
rules that appear higher up in the list.  :-)

Thanks again,
Christoff Snijders


To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-questions" in the body of the message