From owner-freebsd-questions Tue Feb 25 16: 9:59 2003 Delivered-To: freebsd-questions@freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id CBA3D37B401 for ; Tue, 25 Feb 2003 16:09:56 -0800 (PST) Received: from whowhere.com (in02-fes1.whowhere.com [209.202.220.218]) by mx1.FreeBSD.org (Postfix) with SMTP id 74CC343FBD for ; Tue, 25 Feb 2003 16:09:56 -0800 (PST) (envelope-from bsdaemon@eudoramail.com) Received: from Unknown/Local ([?.?.?.?]) by whowhere.com; Wed, 26 Feb 2003 00:09:43 -0000 To: "Questions" Date: Tue, 25 Feb 2003 16:09:43 -0800 From: "Joshua Lokken" Message-ID: Mime-Version: 1.0 X-Sent-Mail: on Reply-To: bsdaemon@eudoramail.com X-Mailer: MailCity Service X-Priority: 3 Subject: Fwd: ipfw rule placement X-Sender-Ip: 130.94.160.46 Organization: Lycos Mail (http://www.mail.eudoramail.com) Content-Type: multipart/mixed; boundary="=_-=_-PNHKHLPGOOMEHBAA" Content-Transfer-Encoding: 7bit Sender: owner-freebsd-questions@FreeBSD.ORG Precedence: bulk List-ID: List-Archive: (Web Archive) List-Help: (List Instructions) List-Subscribe: List-Unsubscribe: X-Loop: FreeBSD.ORG This is a multi-part message in MIME format. You need a MIME compliant mail reader to completely decode it. --=_-=_-PNHKHLPGOOMEHBAA Content-Type: text/plain; charset=us-ascii Content-Language: en Content-Length: 1015 Content-Transfer-Encoding: 7bit --------- Forwarded Message --------- DATE: Tue, 25 Feb 2003 16:06:22 From: "Joshua Lokken" To: "Questions" Hello, Primary harddisk failed on my 4.7-release gateway (ipfw+natd) box last weekend, and I had not backed things up properly. Attached is my ipfw ruleset. After the rebuild, I rewrote things from memory. When I remove the default deny rule from the list, nat works fine, port redirections and all, but with the deny rule in place, nat isn't working, so I'm thinking I have a rule in the wrong place. Can anyone point out any obvious missing/misplaced rules here? Thanks much. --- Joshua Lokken FreeBSD: The Power to Serve! bsdaemon@eudoramail.com --------------------------------> --------- End Forwarded Message --------- My apologies for the missing attachment... and for the M$ formatted file ;( Need a new email address that people can remember Check out the new EudoraMail at http://www.eudoramail.com --=_-=_-PNHKHLPGOOMEHBAA Content-Type: text/plain; charset=us-ascii; name="firewall.conf" Content-Language: en Content-Length: 512 Content-Transfer-Encoding: 7bit $fwcmd -f flush $fwcmd add allow all from any to any via lo0 $fwcmd add divert natd all from any to any via $oif $fwcmd add allow tcp from any to $oip 22,80,443,6346,22002,22003,22010 setup $fwcmd add allow tcp from any to any established $fwcmd add allow icmp from any to any icmptypes 3,4,11,12 $fwcmd add check-state $fwcmd add allow ip from $oip to any keep-state out via $oif $fwcmd add allow ip from $inwr to any keep-state via $iif $fwcmd add 65435 deny log ip from any to any --=_-=_-PNHKHLPGOOMEHBAA-- To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-questions" in the body of the message