Date: Sun, 7 Jan 2001 17:27:11 -0800 From: "Crist J. Clark" <cjclark@reflexnet.net> To: blaz <blaz@satx.rr.com> Cc: freebsd-questions@FreeBSD.ORG Subject: Re: firewall problems Message-ID: <20010107172711.B95729@rfx-64-6-211-149.users.reflexco> In-Reply-To: <3A58E5D1.69A6D302@satx.rr.com>; from blaz@satx.rr.com on Sun, Jan 07, 2001 at 03:55:29PM -0600 References: <3A58E5D1.69A6D302@satx.rr.com>
next in thread | previous in thread | raw e-mail | index | archive | help
On Sun, Jan 07, 2001 at 03:55:29PM -0600, blaz wrote:
Seems like I've seen this a few times.
> I added the following to my kernel and rebuilt:
>
> options IPFIREWALL
> options IPFIREWALL_VERBOSE
> options IPFIREWALL_VERBOSE_LIMIT=100
> options IPDIVERT
>
>
> then I added to /etc/rc.conf:
>
> gateway_enable="YES"
> firewall_enable="YES"
> natd_enable="YES"
> natd_interface="xl0" # my NIC connected to cable modem
> natd_flags="-dynamic"
> firewall_script="/etc/rc.firewall.new"
OK.
[snip]
> I will supply the rules at the end, in case it is -- I am going
> by an article I read on bsdtoday.com.. anyway here is what
> I supplied:
>
>
> fwcmd="/sbin/ipfw" #leave as is if using ipfw
> oif="xl0" #set to outside interface name
> onwr="255.255.255.0" #set to outside network range
> I am not sure about this..
It's never used in the rules below, so it doesn't matter what you do
with this. But if it is meant to be like ${inwr}, it should probably
be the network and not just the netmask.
> oip="my ip" #set to outside ip address
> I use DHCP, but supplied current IP
> this has to be wrong
If you need an IP for your rules, you will need to do this
automatically.
> iif="xl1" #set to internal interface name
> inwr="192.168.2/24" #set to internal network range
This will not work how you expect. Try,
inwr="192.168.2.0/24"
Read inet_network(3) if you want to know why. Although,
inwr="192.168.512/24"
Should work if you want to use three-dot notation.
This _might_ be your problem. Also, output of 'ipfw show' is always
very helpful to see how the rules actually get loaded.
> iip="192.168.2.1" #set to internal ip address
> ns1="my name server" #set to primary name server best if = oif
> ntp="clock.isc.org" #set to ip of NTP server or leave as is
[snip]
Try fixing that and see if it helps.
--
Crist J. Clark cjclark@alum.mit.edu
To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-questions" in the body of the message
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20010107172711.B95729>