Skip site navigation (1)Skip section navigation (2)
Date:      Wed, 14 Jan 2004 14:42:10 -0800
From:      Rishi Chopra <rchopra@cal.berkeley.edu>
To:        freebsd-questions@FreeBSD.ORG
Subject:   Re: (Yet Another) Home Networking Question
Message-ID:  <4005C5C2.20302@cal.berkeley.edu>
In-Reply-To: <44ptdolfwd.fsf@be-well.ilk.org>
References:  <200401111053.QAA05193@manage.24online> <40035568.6010306@cal.berkeley.edu> <44ptdolfwd.fsf@be-well.ilk.org>

next in thread | previous in thread | raw e-mail | index | archive | help
A question about the 'me' keyword and ipfw: The man page for ipfw states 
the following:

          me      matches any IP address configured on an interface in the
                     system.  The address list is evaluated at the time the
                     packet is analysed.

If I set my oif to 'rl0' (a nic in my system) and I set the oip to 'me', 
what should the onet address be set to?  Can I set the onet address to 
'me' also?  The oif has its address assigned by DHCP.

-R

Lowell Gilbert wrote:

>Rishi Chopra <rchopra@cal.berkeley.edu> writes:
>
>  
>
>>Perhaps someone can help me with this small part of rc.firewall:
>>
>>[Ss][Ii][Mm][Pp][Ll][Ee])
>>        ############
>>        # This is a prototype setup for a simple firewall.  Configure this
>>        # machine as a named server and ntp server, and point all the machines
>>        # on the inside at this machine for those services.
>>        ############
>>
>>        # set these to your outside interface network and netmask and ip
>>        oif="ed0"
>>        onet="192.0.2.0"
>>        omask="255.255.255.0"
>>        oip="192.0.2.1"
>>
>>        # set these to your inside interface network and netmask and ip
>>        iif="ed1"
>>        inet="192.0.2.1"
>>        imask="255.255.255.0"
>>        iip="192.0.2.17"
>>
>>I'm curious about the difference between 'inet' and 'iip', what each
>>one stands for, and how to configure 'onet/oip' if the outside
>>interface network is configured via DHCP.
>>    
>>
>
>Look a little more closely at the comment right before those lines.
>'iif' is "Inside InterFace," 'inet' is "Inside NETwork," 'imask' is
>"Inside netMASK," and 'iip' is "Inside IP address."
>
>If your ouside address is assigned by DHCP, you can't set those in the
>script.  You can use the "me" keyword (see "man 8 ipfw"), or set up
>the firewall in a DHCP hook, or just skip the address (it doesn't
>actually give you any extra security if you've got a single address on
>a single Ethernet network).
>
>  
>
>>I'm also curious about this little snippet (under the 'simple' profile):
>>
>>        # Everything else is denied by default, unless the
>>        # IPFIREWALL_DEFAULT_TO_ACCEPT option is set in your kernel
>>        # config file.
>>
>>What happens if this option is set in my kernel config file?  Can I
>>safely comment out this line and use the 'simple' profile without
>>affecting natd?
>>    
>>
>
>It doesn't affect natd either way.  Defaulting to deny is definitely
>the way to configure a firewall for security purposes -- don't accept
>anything you haven't explicitly configured yourself to let in.
>
>  
>



Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?4005C5C2.20302>