From owner-freebsd-questions@FreeBSD.ORG Wed Dec 24 13:43:54 2003 Return-Path: Delivered-To: freebsd-questions@freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id B432F16A4CE for ; Wed, 24 Dec 2003 13:43:54 -0800 (PST) Received: from be-well.no-ip.com (lowellg.ne.client2.attbi.com [66.30.200.37]) by mx1.FreeBSD.org (Postfix) with ESMTP id 6AE1B43D2F for ; Wed, 24 Dec 2003 13:43:53 -0800 (PST) (envelope-from freebsd-questions-local@be-well.ilk.org) Received: by be-well.no-ip.com (Postfix, from userid 1147) id 93F7566; Wed, 24 Dec 2003 16:43:49 -0500 (EST) Sender: lowell@be-well.ilk.org To: "Drew Robertson" References: From: Lowell Gilbert Date: 24 Dec 2003 16:43:49 -0500 In-Reply-To: Message-ID: <44smj9nb6y.fsf@be-well.ilk.org> Lines: 40 User-Agent: Gnus/5.09 (Gnus v5.9.0) Emacs/21.3 MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii cc: freebsd-questions@freebsd.org Subject: Re: IPFW Rule set question... X-BeenThere: freebsd-questions@freebsd.org X-Mailman-Version: 2.1.1 Precedence: list Reply-To: freebsd-questions@freebsd.org List-Id: User questions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 24 Dec 2003 21:43:54 -0000 "Drew Robertson" writes: > I have enabled SSH, TELNET and FTP on my freeBSD 4.8 box at home... it > is dual homed, 2 NICs one for the internal LAN one running my cable > modem. Everything works fine on the internal side. > > When accessing the box using any of those apps from work, the system > looks to briefly connect and then returns a "Connection Lost" or > "Connection closed by remote host error". > > The command setup to allow in access is as follows... > > 820 allow log tcp from any to me 22 limit src-addr 4 in recv tl0 setup > 830 allow log tcp from any to me 23 limit src-addr 4 in recv tl0 setup I assume these are supposed to have "keep-state" in them. It *is* written that way in the full ruleset you posted lower down. > when this didn't work I added another command at the start of the > ruleset to just let everything in from a particular IP address range... > > 202 allow ip from 203.10.10.0/24 to any > > however this produced the same error... > > It wasn't until I allowed all from any to any that I was able to connect... Then the packets aren't actually being seen as coming from that address. Maybe you're running into NAT modifications? > When checking out the security log, it tells me that rule 820 is > allowing access to my computer at home... But only for SYN packets... -- Lowell Gilbert, embedded/networking software engineer, Boston area: resume/CV at http://be-well.ilk.org:8088/~lowell/resume/ username/password "public"