Date: Fri, 28 Dec 2001 11:19:38 -0500 From: "Joe & Fhe Barbish" <barbish@a1poweruser.com> To: "Simon 'corecode' Schubert" <corecode@corecode.ath.cx> Cc: "FBSD Questions" <questions@FreeBSD.ORG> Subject: RE: IPFW rc.firewall Message-ID: <LPBBIGIAAKKEOEJOLEGOKEJNCKAA.barbish@a1poweruser.com> In-Reply-To: <20011228120842.0f3205df.corecode@corecode.ath.cx>
next in thread | previous in thread | raw e-mail | index | archive | help
I reviewed your tutorial. I see that it's a copy of the
rc.firewall file with the symbolic variables for the
"simple" network filled in for your environment. You have
the second statement under the comments #stop spoofing
commented out because in a user ppp dialout to the ISP you
are getting dynamic IP's and this rule needs {onet) & {omask)
a static IP value, which you don't have because it always
changes each time you dial your ISP.
# Stop spoofing
${fwcmd} add deny all from ${inet}:${imask} to any in via ${oif}
# ${fwcmd} add deny all from ${onet}:${omask} to any in via ${iif}
I am in this same situation. I think there is a way to get
the info needed for {onet} & {omask}. The rc.conf file controls
the startup sequence of FBSD functions. If user ppp statements
come before the IPFW statements in rc.conf then FBSD will know
the dynamic IP address before IPFW starts.
As you can see the rc.firewall script can access system symbolic
variables as shown by
case ${natd_enable} in
[Yy][Ee][Ss])
if [ -n "${natd_interface}" ]; then
Here natd_enable and natd_interface are system symbolic variables.
There are also system symbolic variables for the {onet} & {omask}
values resulting from user ppp dialin to the ISP. I need help
determining what these system symbolic variables names are.
Once we know there names, all we have to do is substitute there
names for {onet} & {omask} and we have complete spoofing protection
that correctly changes every time we dialout to the ISP.
Can you help me in this?
Thanks
Joe
-----Original Message-----
From: owner-freebsd-questions@FreeBSD.ORG
[mailto:owner-freebsd-questions@FreeBSD.ORG]On Behalf Of Simon 'corecode'
Schubert
Sent: Friday, December 28, 2001 6:09 AM
To: Joe & Fhe Barbish
Cc: questions@FreeBSD.ORG
Subject: Re: IPFW rc.firewall
On Thu, 27 Dec 2001 19:50:46 -0500 "Joe & Fhe Barbish"
<barbish@a1poweruser.com> wrote:
> In rc.firewall one can configure the simple type of firewall rule set.
> It requests you to enter your settings for
> "your outside network, mask, ip". This looks like it wants a public
> static ip address from ISP. I logon to my ISP using user ppp and get
> a dynamic IP address that is different every time.
>
> What value am I to enter in these fields so it knows it's dynamic ip
> address?
>
you can look at my custom firewall set at
http://corecode.ath.cx/tutorials/
cheerz
corecode
--
/"\ http://corecode.ath.cx/
\ /
\ ASCII Ribbon Campaign
/ \ Against HTML Mail and News
To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-questions" in the body of the message
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?LPBBIGIAAKKEOEJOLEGOKEJNCKAA.barbish>