From owner-freebsd-questions Wed Mar 5 7:34:26 2003 Delivered-To: freebsd-questions@freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id DE66B37B405 for ; Wed, 5 Mar 2003 07:34:24 -0800 (PST) Received: from hotmail.com (oe14.law12.hotmail.com [64.4.18.118]) by mx1.FreeBSD.org (Postfix) with ESMTP id 7FB1143F75 for ; Wed, 5 Mar 2003 07:34:24 -0800 (PST) (envelope-from b1henning@hotmail.com) Received: from mail pickup service by hotmail.com with Microsoft SMTPSVC; Wed, 5 Mar 2003 07:34:24 -0800 X-Originating-IP: [192.216.212.193] From: "Brian Henning" To: "freebsd" Subject: firewall revisited Date: Wed, 5 Mar 2003 09:32:13 -0600 MIME-Version: 1.0 Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: 7bit X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 6.00.2800.1106 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1106 Message-ID: X-OriginalArrivalTime: 05 Mar 2003 15:34:24.0412 (UTC) FILETIME=[B32FDDC0:01C2E32C] Sender: owner-freebsd-questions@FreeBSD.ORG Precedence: bulk List-ID: List-Archive: (Web Archive) List-Help: (List Instructions) List-Subscribe: List-Unsubscribe: X-Loop: FreeBSD.ORG Hello- currently my rc.conf is set up like this for my gateway router. gateway_enable="YES" firewall_enable="YES" firewall_type="OPEN" natd_enable="YES" natd_interface="rl1" # natd -interface rl1, public interface natd_flags="" # sysctl net.inet.ip.forwarding=1 how can i have the script /etc/ipfw.rules run instead of /etc/rc.firewall. can i change firewall_type="OPEN" to firewall_type="" and create the entry firewall_script="/etc/ipfw.rules"? what i would like to do is block all access to services on the router like httpd, sshd, etc the other think i would like to do is port forward ssh from another machine and allow access of that from an external network. does something like this make sense? thanks, brian /etc/rc.firewall.rules ---------------------- #!/bin/sh IPFW=/sbin/ipfw ${IPFW} -f flush ${IPFW} add 00200 divert natd all from any to any via rl1 ${IPFW} add 00250 pass tcp from ${ROUTER_IP} to ${MACHINE1_IP} 22 ${IPFW} add 00260 pass tcp from ${MACHINE1_IP} 22 to ${ROUTER_IP} ${IPFW} add 00300 pass all from any to any To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-questions" in the body of the message