Date: Wed, 1 Nov 2000 10:41:31 +0200 From: Ruslan Ermilov <ru@sunbay.com> To: cjclark@alum.mit.edu Cc: Kenneth Wayne Culver <culverk@wam.umd.edu>, freebsd-questions@FreeBSD.ORG Subject: Re: natd errors. Message-ID: <20001101104131.A41690@sunbay.com> In-Reply-To: <20001101002735.I75251@149.211.6.64.reflexcom.com>; from cjclark@reflexnet.net on Wed, Nov 01, 2000 at 12:27:36AM -0800 References: <Pine.GSO.4.21.0010311622130.13404-100000@rac1.wam.umd.edu> <20001101093421.A33449@sunbay.com> <20001101002735.I75251@149.211.6.64.reflexcom.com>
next in thread | previous in thread | raw e-mail | index | archive | help
On Wed, Nov 01, 2000 at 12:27:36AM -0800, Crist J . Clark wrote:
> On Wed, Nov 01, 2000 at 09:34:21AM +0200, Ruslan Ermilov wrote:
> > On Tue, Oct 31, 2000 at 04:24:12PM -0500, Kenneth Wayne Culver wrote:
> > > I just decided to make my firewall rules more strict, so I set my type to
> > > "simple" in rc.conf... and now I get this error
> > > Oct 31 16:16:07 culverk natd[139]: failed to write packet back (Permission
> > > denied)
> > >
> > This happens when ipfw blocks packets written back by natd(8).
> >
> > > my rules are the same rules as the "simple" specification in rc.firewall.
> > >
> > There was a problem with the stock "simple" firewall, which has now been
> > fixed in 4.1-STABLE (/etc/rc.firewall, rev 1.30.2.5).
> >
> > > Could someone tell me how to get rid of this error?
> > >
> > Make sure your rc.firewall is rev 1.30.2.5 or higher.
>
> Hmmm, I have a 1.30.2.6 file right here and it still looks to me like
> it does not have a chance of working for your average natd(8) setup.
>
If ${oip} and ${onet} are set to some real values, the "simple" firewall
should work. If they are set to some RFC1918 or draft-manning-dsua ones,
this (of course) will not work, and you will have to either delete two
"deny" rules (one before and one after the divert rule) that include your
${onet}:${omask} network. Anything else?
--
Ruslan Ermilov Oracle Developer/DBA,
ru@sunbay.com Sunbay Software AG,
ru@FreeBSD.org FreeBSD committer,
+380.652.512.251 Simferopol, Ukraine
http://www.FreeBSD.org The Power To Serve
http://www.oracle.com Enabling The Information Age
To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-questions" in the body of the message
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20001101104131.A41690>