From owner-freebsd-questions@FreeBSD.ORG Fri Oct 31 16:10:14 2008 Return-Path: Delivered-To: freebsd-questions@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34]) by hub.freebsd.org (Postfix) with ESMTP id 2C6E91065679 for ; Fri, 31 Oct 2008 16:10:14 +0000 (UTC) (envelope-from jdc@koitsu.dyndns.org) Received: from QMTA08.emeryville.ca.mail.comcast.net (qmta08.emeryville.ca.mail.comcast.net [76.96.30.80]) by mx1.freebsd.org (Postfix) with ESMTP id 087198FC21 for ; Fri, 31 Oct 2008 16:10:13 +0000 (UTC) (envelope-from jdc@koitsu.dyndns.org) Received: from OMTA03.emeryville.ca.mail.comcast.net ([76.96.30.27]) by QMTA08.emeryville.ca.mail.comcast.net with comcast id ZUA11a00S0b6N64A8UAD13; Fri, 31 Oct 2008 16:10:13 +0000 Received: from koitsu.dyndns.org ([69.181.141.110]) by OMTA03.emeryville.ca.mail.comcast.net with comcast id ZU9p1a00t2P6wsM8PU9uWm; Fri, 31 Oct 2008 16:09:58 +0000 X-Authority-Analysis: v=1.0 c=1 a=6I5d2MoRAAAA:8 a=QycZ5dHgAAAA:8 a=aeNJTPYlkxznVfWyPO8A:9 a=m1wMjBu197KkGEAHCABYufuO5t4A:4 a=EoioJ0NPDVgA:10 a=SV7veod9ZcQA:10 a=LY0hPdMaydYA:10 Received: by icarus.home.lan (Postfix, from userid 1000) id 6A370C9419; Fri, 31 Oct 2008 09:09:49 -0700 (PDT) Date: Fri, 31 Oct 2008 09:09:49 -0700 From: Jeremy Chadwick To: Freebsd questions Message-ID: <20081031160949.GA36045@icarus.home.lan> References: <367168.61424.qm@web56806.mail.re3.yahoo.com> <490A4487.8020101@gmail.com> <20081030233933.GB16747@icarus.home.lan> <448ws4da2f.fsf@be-well.ilk.org> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <448ws4da2f.fsf@be-well.ilk.org> User-Agent: Mutt/1.5.18 (2008-05-17) Cc: Jack Barnett , mdh_lists@yahoo.com Subject: Re: Firewalls in FreeBSD? X-BeenThere: freebsd-questions@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: User questions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 31 Oct 2008 16:10:14 -0000 On Fri, Oct 31, 2008 at 12:05:28PM -0400, Lowell Gilbert wrote: > Jeremy Chadwick writes: > > > On Thu, Oct 30, 2008 at 06:34:31PM -0500, Jack Barnett wrote: > >> > >> Ok, I had some progress with this last night. Basically what I do is: > >> > >> in natd - redirect_port 1000 to 10000 to the internal windows box. > >> set ipfw to "open" file wall. > >> > >> Obviously this isn't prefect - but gives some idea of what's going on. > >> > >> What I'd like to do, is a) keep the nat redirects since that works > >> pretty well. > >> b) in ipfw, ONLY allow data back on these ports IF the windows box has > >> established the connection out first then deny everything else. > > > > This is called "port triggering" in the residential router world. I > > don't know how to do this on FreeBSD. > > Stateful rules are the only way to do it. > In fact, this is the main purpose of stateful rules. Read this part of the thread, where I outline protocol flow (based on what the OP has stated about the protocol, which so far appears to be accurate): http://lists.freebsd.org/pipermail/freebsd-questions/2008-October/thread.html Stateful rules will not solve this problem. The OP wants a feature that tells ipfw or pf "after the TCP handshake has completed, dynamically add a port forward for port X on interface Y to machine A on port Z; when the TCP session is FIN'd cleanly, or extinguishes, dynamically remove that port forward". -- | Jeremy Chadwick jdc at parodius.com | | Parodius Networking http://www.parodius.com/ | | UNIX Systems Administrator Mountain View, CA, USA | | Making life hard for others since 1977. PGP: 4BD6C0CB |