Date: Thu, 25 Nov 1999 12:36:20 +0100 (CET) From: Micke Josefsson <mj@isy.liu.se> To: questions@freebsd.org Subject: IPFW setup Beginner's questions Message-ID: <XFMail.991125123620.mj@isy.liu.se>
next in thread | raw e-mail | index | archive | help
I have just recently started reading Chapman and Zwicky's Building Internet
Firewalls and am a bit confused.
While the book talks about direction of traffic they hardly ever mention which
interface to use. In our ipfw rules we can specify to filter traffic 'via fxp0'
for example, but the book seems rarely interested in that.
To prevent internal IPnumbers to come from the outside we specify:
$fwcmd add deny all from ${inet}:${imask} to any in via ${oif}
$fwcmd add deny all from ${onet}:${omask} to any in via ${iif}
where inet/imask and oif are our internal net and netmask and outer interface,
and onet/omask and iif are outer net, outer netmask and inner interface.
This seems logical, but what about for exampel telnet (port 23); will a rule of
$fwcmd add pass tcp from any to ${oip} 23 setup #oip = outer ip
allow contact to telnetd from both of my interfaces, but not *through* my
firewall? (i.e. *between* interfaces?) what about specifying interfaces in this
case?
If I only want my internal net to access telnetd do I have to set up a rule via
vx0 (my 192.168-interface), and another rule for fxp0 (my 130.236-interface)?
And does direction have its origin in the firewall, sitting between the two
interfaces? So that telnet access from my internal net to external net is
'incoming' from vx0 to firewall and 'outgoing' from firewall to the rest of the
world?
In any case I have sysctl.inet.ip.forwarding=0, so that any traffic at all must
trickle through my firewall.
It really is an amazing subject, anyway:)
Cheers,
Micke
----------------------------------
Michael Josefsson, MSEE
mj@isy.liu.se
This message was sent by XFMail
running on FreeBSD 3.1
----------------------------------
To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-questions" in the body of the message
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?XFMail.991125123620.mj>