Skip site navigation (1)Skip section navigation (2)
Date:      Tue, 19 Sep 2000 23:22:13 -0700
From:      "Crist J . Clark" <cjclark@reflexnet.net>
To:        Chip <chip@wiegand.org>
Cc:        "seafug@dub.net" <seafug@dub.net>, "freebsd-questions@freebsd.org" <freebsd-questions@FreeBSD.ORG>
Subject:   Re: natd does port forwarding?
Message-ID:  <20000919232213.Q367@149.211.6.64.reflexcom.com>
In-Reply-To: <39C84A4B.766B5B24@wiegand.org>; from chip@wiegand.org on Tue, Sep 19, 2000 at 10:25:31PM -0700
References:  <39C6FCCC.D0103226@wiegand.org> <20000918225104.I367@149.211.6.64.reflexcom.com> <39C70308.EF52766F@wiegand.org> <20000919000233.L367@149.211.6.64.reflexcom.com> <39C84A4B.766B5B24@wiegand.org>

next in thread | previous in thread | raw e-mail | index | archive | help
On Tue, Sep 19, 2000 at 10:25:31PM -0700, Chip wrote:
> According to top natd is running, in fact, after a reboot it
> showed two instances of it running. I have attached my rc.conf,
> rc.firewall, and natd.conf in the hopes that someone can tell
> me where I have gone wrong, because port forwarding is not
> working.

OK, I made some observations. What version of FreeBSD are you using,
BTW?

> More details in the text below for any new readers.
> The firewall is basically the default, I will tighten up the
> rules 
> after I get port-forwarding running.

Loosen them up first to get things going, but I mentioned that below.

> Any help would be greatly appreciated.

[snip]

> natd.conf --
>
> use_sockets yes
> same_ports yes
> interface ep1
> redirect_port tcp 192.168.0.7:80 80

> rc.conf --
>
> # This file now contains just the overrides from /etc/defaults/rc.conf
> # please make all changes to this file.
> 
> # -- sysinstall generated deltas -- #
> ifconfig_xl0="inet 192.168.0.1  netmask 255.255.255.0"
> ifconfig_ep1="inet 208.194.173.26 netmask 255.255.255.128"
> hostname="firewall2.wiegand.org"
> linux_enable="YES"
> moused_enable="YES"
> firewall_enable="YES"
> firewall_script="/etc/rc.firewall"
> firewall_type="simple"

Open things up to get them working first,

  firewall_type="open"

> gateway_enable="YES"
> router_enable="YES"

Remove this. It is not needed.

> defaultrouter="208.194.173.1"
> natd_enable="YES"
> natd_interface="ep1"

You forgot,

  natd_flags="-f /etc/natd.conf"

> rc.firewall --
>
> ############
> # Setup system for firewall service.
> # $FreeBSD: src/etc/rc.firewall,v 1.30 2000/02/06 19:24:37 paul Exp $
> 
> # Suck in the configuration variables.
> if [ -r /etc/defaults/rc.conf ]; then
> 	. /etc/defaults/rc.conf
> if [ -r /etc/rc.conf ]; then
> 	. /etc/rc.conf
> fi
> 
> ############
> # Define the firewall type in /etc/rc.conf.  Valid values are:
> #   open     - will allow anyone in
> #   client   - will try to protect just this machine
> #   simple   - will try to protect a whole network
> #   closed   - totally disables IP services except via lo0 interface
> #   UNKNOWN  - disables the loading of firewall rules.
> #   filename - will load the rules in the given filename (full path required)
> #
> # For ``client'' and ``simple'' the entries below should be customized
> # appropriately.
> 
> ############
> #
> # If you don't know enough about packet filtering, we suggest that you
> # take time to read this book:
> #
> #	Building Internet Firewalls
> #	Brent Chapman and Elizabeth Zwicky
> #
> #	O'Reilly & Associates, Inc
> #	ISBN 1-56592-124-0
> #	http://www.ora.com/
> #
> # For a more advanced treatment of Internet Security read:
> #
> #	Firewalls & Internet Security
> #	Repelling the wily hacker
> #	William R. Cheswick, Steven M. Bellowin
> #
> #	Addison-Wesley
> #	ISBN 0-201-6337-4
> #	http://www.awl.com/
> #
> 
> if [ -n "${1}" ]; then
> 	ifirewall_type="${1}"
> fi
> 
> ############
> # Set quiet mode if requested
> #
> case ${firewall_quiet} in
> [Yy][Ee][Ss])
> 	fwcmd="/sbin/ipfw -q"
> 	;;
> *)
> 	ifwcmd="/sbin/ipfw"
> 	;;
> esac
> 
> ############
> # Flush out the list before we begin.
> #
> /sbin/ipfw -f flush
> 
> ############
> # These rules are required for using natd.  All packets are passed to
> # natd before they encounter your remaining rules.  The firewall rules
> # will then be run again on each packet after translation by natd,
> # minus any divert rules (see natd(8)).
> #
> #case ${natd_enable} in
> #[Yy][Ee][Ss])
> #	if [ -n "ep1" ]; then
>         /sbin/ipfw add divert natd all from any to any via ep1		
> #fi
> #	;;
> #esac

This has been modified.

> ############
> # If you just configured ipfw in the kernel as a tool to solve network
> # problems or you just want to disallow some particular kinds of traffic
> # then you will want to change the default policy to open.  You can also
> # do this as your only action by setting the firewall_type to ``open''.
> #
>      /sbin/ipfw add 65000 pass all from any to any

Why is this uncommented?

> ############
> # Only in rare cases do you want to change these rules
> #
> /sbin/ipfw add 100 pass all from any to any via lo0
> /sbin/ipfw add 200 deny all from any to 127.0.0.0/8
> # If you're using 'options BRIDGE', uncomment the following line to pass ARP
> #${fwcmd} add 300 pass udp from 0.0.0.0 2054 to 0.0.0.0
> 
> 
> # Prototype setups.
> #
> case ${firewall_type} in
> [Oo][Pp][Ee][Nn])
> #if [ "${firewall}" = "open" ]; then

Hmmm...

> 	/sbin/ipfw add 65000 pass all from any to any
> ;;	
> 
> [Cc][Ll][Ii][Ee][Nn][Tt])
> 	############
> 	# This is a prototype setup that will protect your system somewhat
> 	# against people from outside your own network.
> 	############
> #elif [ "${firewall}" = "client" ]; then

This was in the default? What version again?

> 	# set these to your network and netmask and ip
> 	net="192.168.0.0"
> 	mask="255.255.255.0"
> 	ip="192.168.0.1"
> 
> 	# Allow any traffic to or from my own net.
> 	/sbin/ipfw add pass all from ${ip} to ${net}:${mask}
> 	/sbin/ipfw add pass all from ${net}:${mask} to ${ip}
> 
> 	# Allow TCP through if setup succeeded
> 	/sbin/ipfw add pass tcp from any to any established
> 
> 	# Allow IP fragments to pass through
> 	/sbin/ipfw add pass all from any to any frag
> 
> 	# Allow setup of incoming email
> 	/sbin/ipfw add pass tcp from any to ${ip} 25 setup
> 
> 	# Allow setup of outgoing TCP connections only
> 	/sbin/ipfw add pass tcp from ${ip} to any setup
> 
> 	# Disallow setup of all other TCP connections
> 	/sbin/ipfw add deny tcp from any to any setup
> 
> 	# Allow DNS queries out in the world
> 	/sbin/ipfw add pass udp from any 53 to ${ip}
> 	/sbin/ipfw add pass udp from ${ip} to any 53
> 
> 	# Allow NTP queries out in the world
>         /sbin/ipfw add pass udp from any 123 to ${ip}
> 	/sbin/ipfw add pass udp from ${ip} to any 123
> 
> 	# Everything else is denied by default, unless the
> 	# IPFIREWALL_DEFAULT_TO_ACCEPT option is set in your kernel
> 	# config file.
> 	;;
> 
> [Ss][Ii][Mm][Pp][Ll][Ee])
> 	############
> 	# This is a prototype setup for a simple firewall.  Configure this
> 	# machine as a named server and ntp server, and point all the machines
> 	# on the inside at this machine for those services.
> 	############
> #elif [ "${firewall}" = "simple" ]; then
> 	# set these to your outside interface network and netmask and ip
> 	oif="ep1"
> 	onet="208.240.173.0"
> 	omask="255.255.255.128"
> 	oip="208.240.173.26"

These numbers do not match the ones you gave above in rc.conf.

> 	# set these to your inside interface network and netmask and ip
> 	iif="xl0"
> 	inet="192.168.0.0"
> 	imask="255.255.255.0"
> 	iip="192.168.0.1"
> 
> 	# Stop spoofing
> 	/sbin/ipfw add deny all from ${inet}:${imask} to any in via ${oif}
> 	/sbin/ipfw add deny all from ${onet}:${omask} to any in via ${iif}
> 
> 	# Stop RFC1918 nets on the outside interface
> 	/sbin/ipfw add deny all from 10.0.0.0/8 to any via ${oif}
> 	/sbin/ipfw add deny all from any to 10.0.0.0/8 via ${oif}
> 	/sbin/ipfw add deny all from 172.16.0.0/12 to any via ${oif}
> 	/sbin/ipfw add deny all from any to 172.16.0.0/12 via ${oif}
> 	/sbin/ipfw add deny all from 192.168.0.0/16 to any via ${oif}
> 	/sbin/ipfw add deny all from any to 192.168.0.0/16 via ${oif}
> 
> 	# Stop draft-manning-dsua-01.txt nets on the outside interface
> 	/sbin/ipfw add deny all from 0.0.0.0/8 to any via ${oif}
> 	/sbin/ipfw add deny all from any to 0.0.0.0/8 via ${oif}
> 	/sbin/ipfw add deny all from 169.254.0.0/16 to any via ${oif}
> 	/sbin/ipfw add deny all from any to 169.254.0.0/16 via ${oif}
> 	/sbin/ipfw add deny all from 192.0.2.0/24 to any via ${oif}
> 	/sbin/ipfw add deny all from any to 192.0.2.0/24 via ${oif}
> 	/sbin/ipfw add deny all from 224.0.0.0/4 to any via ${oif}
> 	/sbin/ipfw add deny all from any to 224.0.0.0/4 via ${oif}
> 	/sbin/ipfw add deny all from 240.0.0.0/4 to any via ${oif}
> 	/sbin/ipfw add deny all from any to 240.0.0.0/4 via ${oif}
> 
>         # Allow TCP through if setup succeeded
> 	/sbin/ipfw add pass tcp from any to any established
> 
> 	# Allow IP fragments to pass through
> 	/sbin/ipfw add pass all from any to any frag
> 
> 	# Allow setup of incoming email
> 	/sbin/ipfw add pass tcp from any to ${oip} 25 setup
> 
> 	# Allow access to our DNS
> 	/sbin/ipfw add pass tcp from any to ${oip} 53 setup
> 	/sbin/ipfw add pass udp from any to ${oip} 53
> 	/sbin/ipfw add pass udp from ${oip} 53 to any
> 
> 	# Allow access to our WWW
> 	/sbin/ipfw add pass tcp from any to ${oip} 80 setup
> 
> 	# Reject&Log all setup of incoming connections from the outside
> 	/sbin/ipfw add deny log tcp from any to any in via ${oif} setup
> 
> 	# Allow setup of any other TCP connection
> 	/sbin/ipfw add pass tcp from any to any setup
> 
> 	# Allow DNS queries out in the world
> 	/sbin/ipfw add pass udp from any 53 to ${oip}
> 	/sbin/ipfw add pass udp from ${oip} to any 53
> 
> 	# Allow NTP queries out in the world
> 	/sbin/ipfw add pass udp from any 123 to ${oip}
> 	/sbin/ipfw add pass udp from ${oip} to any 123
> 
> 	# Everything else is denied by default, unless the
> 	# IPFIREWALL_DEFAULT_TO_ACCEPT option is set in your kernel
> 	# config file.
> 	;;
>         fi
> )
> #[Uu][Nn][Kk][Nn][Oo][Ww][Nn])
> 
> 	;;
> )
> )
> #	if [ -r "${firewall_type}" ]; then
> 	/sbin/ipfw ${firewall_flags} ${firewall_type}
> #        fi
> 	;;
> esac
> fi


-- 
Crist J. Clark                           cjclark@alum.mit.edu


To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-questions" in the body of the message




Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20000919232213.Q367>