From owner-freebsd-questions Tue Oct 16 12:54:46 2001 Delivered-To: freebsd-questions@freebsd.org Received: from gull.mail.pas.earthlink.net (gull.mail.pas.earthlink.net [207.217.121.85]) by hub.freebsd.org (Postfix) with ESMTP id A8B7F37B40D for ; Tue, 16 Oct 2001 12:54:41 -0700 (PDT) Received: from blossom.cjclark.org (dialup-209.247.143.200.Dial1.SanJose1.Level3.net [209.247.143.200]) by gull.mail.pas.earthlink.net (EL-8_9_3_3/8.9.3) with ESMTP id MAA01564; Tue, 16 Oct 2001 12:54:32 -0700 (PDT) Received: (from cjc@localhost) by blossom.cjclark.org (8.11.6/8.11.3) id f9GJsQr04909; Tue, 16 Oct 2001 12:54:26 -0700 (PDT) (envelope-from cjc) Date: Tue, 16 Oct 2001 12:54:25 -0700 From: "Crist J. Clark" To: Bjarne Wichmann Petersen Cc: freebsd-questions@FreeBSD.ORG Subject: Re: Firewall not logging Message-ID: <20011016125425.B4437@blossom.cjclark.org> Reply-To: cjclark@alum.mit.edu References: <20011016085031.ZUFR22989.fepB.post.tele.dk@there> <20011016020733.F293@blossom.cjclark.org> <20011016111536.VWHS23247.fepA.post.tele.dk@there> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline User-Agent: Mutt/1.2.5i In-Reply-To: <20011016111536.VWHS23247.fepA.post.tele.dk@there>; from mekanix@privat.dk on Tue, Oct 16, 2001 at 01:18:19PM +0200 Sender: owner-freebsd-questions@FreeBSD.ORG Precedence: bulk List-ID: List-Archive: (Web Archive) List-Help: (List Instructions) List-Subscribe: List-Unsubscribe: X-Loop: FreeBSD.ORG On Tue, Oct 16, 2001 at 01:18:19PM +0200, Bjarne Wichmann Petersen wrote: > On Tuesday 16 October 2001 11:07, Crist J. Clark wrote: > > > > # Allow all data from my network card and localhost. Make sure you > > > # change your network card (mine was fxp0) before you reboot. :) > > > $fwcmd add allow ip from any to any via lo0 > > > $fwcmd add allow ip from any to any via xl0 > > > > All traffic is being passed by these two rules. Neither of these rules > > log. None of the log rules that are below this are ever reached. > > Hmm, I've got this from > http://www.freebsd.org/doc/en_US.ISO8859-1/articles/dialup-firewall/rules.html > with a few modifications. That is for a machine doing dial-up. That is the machine is a gateway with two interfaces, fxp0 and tun0. Your firewall rules only ever refered to one interface, xl0. > I'm not very well versed into ipfw, but I think the idea here is that trafic > behind the wall should go unhindered. Should I substitue "via" with "out > xmit" instead? Just commenting those to lines out would propably give me a > lot of headaches. "Behind the wall?" Your rules did not make this machine look like a gateway. Perhaps we don't understand your configuration. -- Crist J. Clark | cjclark@alum.mit.edu | cjclark@jhu.edu http://people.freebsd.org/~cjc/ | cjc@freebsd.org To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-questions" in the body of the message