Date: Wed, 31 Mar 2004 20:27:01 +0200 From: "Prodigy" <prodigy@punktas.lt> To: "freebsd-questions" <freebsd-questions@freebsd.org> Subject: problems with ipfw + natd rules Message-ID: <003f01c4174d$c38ffa50$6900a8c0@prodigy>
next in thread | raw e-mail | index | archive | help
Hello,
i have a problem with ipfw + natd. The problem is that my FreeBSD server
isn't routing internet. First I have used FreeBSD4.9-STABLE, then i tried to
upgrade to FreeBSD4.9-RELEASE-p4. Result is the same - no internet for lan
users. Take a look at my configuration files:
rc.conf:
defaultrouter="213.190.42.1"
hostname="localhost"
ifconfig_rl0="inet 192.168.0.1 netmask 255.255.255.0" # inside (lan)
interface
ifconfig_rl1="inet 213.190.42.48 netmask 255.255.255.0" # outside (internet)
interface
#some other stuff goes here
gateway_enable="YES"
natd_enable="YES"
natd_program="/sbin/natd"
natd_interface="rl1"
natd_flags=""
firewall_enable="YES"
firewall_script="/usr/local/etc/ipfw.conf"
firewall_quiet="YES"
firewall_logging="YES"
ipfw.conf:
fwcmd="/sbin/ipfw -q"
${fwcmd} -f flush
${fwcmd} add 100 divert 8668 ip from any to any via rl1
${fwcmd} add 200 pass ip from any to any via lo0
${fwcmd} add 300 deny log ip from any to 127.0.0.0/8
${fwcmd} add 400 pass tcp from any 22,80,110,119,143,443,3306,5190,6667-7000
to any via rl1
${fwcmd} add 500 pass tcp from any to any
22,80,110,119,143,443,3306,5190,6667-7000 via rl1
${fwcmd} add 600 pass udp from any to any 53 via rl1
${fwcmd} add 700 pass udp from any 53 to any via rl1
${fwcmd} add 800 pass ip from any to any via rl0
${fwcmd} add 900 deny log all from any to any via rl1
# ipfw show
00100 80 48557 divert 8668 ip from any to any via rl1
00200 0 0 allow ip from any to any via lo0
00300 0 0 deny log ip from any to 127.0.0.0/8
00400 54 59678 allow tcp from any
22,80,110,119,143,443,3306,5190,6667-7000 to any via rl1
00500 26 1473 allow tcp from any to any dst-port
22,80,110,119,143,443,3306,5190,6667-7000 via rl1
00600 3 177 allow udp from any to any dst-port 53 via rl1
00700 0 0 allow udp from any 53 to any via rl1
00800 226 101368 allow ip from any to any via rl0
00900 62 40857 deny log ip from any to any via rl1
65535 1598 333640 deny ip from any to any
/etc/sysctl.conf:
net.link.ether.ipfw=1
# cat /etc/services | grep natd
natd 8668/divert # Network Address Translation
When I comment out 400 and 500 rules and add "allow all from any to any via
rl1" it's all ok. The problem is somewhere in 400 and 500 rules.
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?003f01c4174d$c38ffa50$6900a8c0>