From owner-freebsd-questions Fri Sep 29 9:48:24 2000 Delivered-To: freebsd-questions@freebsd.org Received: from absinthe.yi.org (adsl-63-192-100-220.dsl.chic01.pacbell.net [63.192.100.220]) by hub.freebsd.org (Postfix) with ESMTP id 4139837B422 for ; Fri, 29 Sep 2000 09:48:21 -0700 (PDT) Received: (from fred@localhost) by absinthe.yi.org (8.11.0/8.11.0) id e8TGmLH40209 for questions@freebsd.org; Fri, 29 Sep 2000 09:48:21 -0700 (PDT) (envelope-from fred) Received: from autobot.veldt.com (vi-216-128-57-99-l3-rb1.anhmcaidc.firstworld.net [216.128.57.99]) by absinthe.yi.org (8.11.0/8.11.0) with ESMTP id e8T9i0U39383 for ; Fri, 29 Sep 2000 02:44:00 -0700 (PDT) (envelope-from james@veldt.com) Received: from [192.168.1.2] ([192.168.1.2]) by autobot.veldt.com (8.9.3/8.9.3) with ESMTP id DAA00298 for ; Fri, 29 Sep 2000 03:43:53 -0600 (MDT) (envelope-from james@veldt.com) Mime-Version: 1.0 X-Sender: james@autobot.veldt.com Message-Id: Date: Fri, 29 Sep 2000 03:43:06 -0600 To: Fred Condo From: James Gorham Subject: Help! IPFW Problems Content-Type: text/plain Sender: owner-freebsd-questions@FreeBSD.ORG Precedence: bulk X-Loop: FreeBSD.ORG Greetings. I'm having quite a bit of trouble, and it seems to be related to IP Divert and/or IP firewall. A bit of background... I compiled a custom kernel when I first installed FreeBSD, with: options IPDIVERT options IPFIREWALL as the only custom options from the GENERIC config, other than some custom screen colors. I ran my local network of a FreeBSD machine acting as the gateway for a single IP DSL connection to 2 macs on the LAN. It worked fine until I decided to install netatalk. I added the: options NETATALK to the same kernel file I used originally, config'd the file, make depend, make, and make install'd the kernel. Upon reboot I began getting messages such as: 00100 allow ip from any to any via lo0 ifw: setsockopt(IP_FW_ADD): Invalid argument 00200 deny ip from any to 127.0.0.0/8 ipfw: setsockop(IP_FW-AD): Invalid Argument 65000 allow ip from any to any ipfw: setsockopt(IP_FW_ADD): Invalid argument during boot process. After booting, and logging in, all tcp/ip functions were unavailble. Things like ping, would get: sendto: Permission denied. I tried removing the netatalk option from the Kernel file, recompiling and installing, and STILL get the ipfw errors. I had the following two lines in my rc.conf file: firewall_enable="YES" firewall_type="open" Originally (before the netatalk compile) these worked fine. If I comment these two lines out now, I can do my TCP/IP functions, but I cannot get any of the machines on the LAN on the internet, due to natd not being enabled. I gave up, and tried compiling the GENERIC kernel. After installing this kernel, I still cannot leave the above two lines in my rc.conf uncommented, or else I'll have no tcp/ip functions. I've never touched the rc.firewall file, nor have I ever cvsup'd the /usr/src directory. I've only updated the /usr/ports. If you have any idea at all as to what I should do, please let me know. I'm in dire need to get these machines back online. Best regards, james To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-questions" in the body of the message