From owner-freebsd-questions@FreeBSD.ORG Fri Oct 31 16:35:32 2008 Return-Path: Delivered-To: freebsd-questions@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34]) by hub.freebsd.org (Postfix) with ESMTP id 3E1201065670 for ; Fri, 31 Oct 2008 16:35:32 +0000 (UTC) (envelope-from freebsd-questions-local@be-well.ilk.org) Received: from mail2.sea5.speakeasy.net (mail2.sea5.speakeasy.net [69.17.117.4]) by mx1.freebsd.org (Postfix) with ESMTP id 135BA8FC12 for ; Fri, 31 Oct 2008 16:35:31 +0000 (UTC) (envelope-from freebsd-questions-local@be-well.ilk.org) Received: (qmail 21787 invoked from network); 31 Oct 2008 16:35:31 -0000 Received: from dsl092-078-145.bos1.dsl.speakeasy.net (HELO be-well.ilk.org) ([66.92.78.145]) (envelope-sender ) by mail2.sea5.speakeasy.net (qmail-ldap-1.03) with SMTP for ; 31 Oct 2008 16:35:31 -0000 Received: by be-well.ilk.org (Postfix, from userid 1147) id 87D8F5082C; Fri, 31 Oct 2008 12:35:30 -0400 (EDT) To: Jeremy Chadwick References: <367168.61424.qm@web56806.mail.re3.yahoo.com> <490A4487.8020101@gmail.com> <20081030233933.GB16747@icarus.home.lan> <448ws4da2f.fsf@be-well.ilk.org> <20081031160949.GA36045@icarus.home.lan> From: Lowell Gilbert Date: Fri, 31 Oct 2008 12:35:30 -0400 In-Reply-To: <20081031160949.GA36045@icarus.home.lan> (Jeremy Chadwick's message of "Fri\, 31 Oct 2008 09\:09\:49 -0700") Message-ID: <444p2sd8od.fsf@be-well.ilk.org> User-Agent: Gnus/5.11 (Gnus v5.11) Emacs/22.2 (berkeley-unix) MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Cc: Jack Barnett , Freebsd questions , mdh_lists@yahoo.com Subject: Re: Firewalls in FreeBSD? X-BeenThere: freebsd-questions@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: User questions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 31 Oct 2008 16:35:32 -0000 Jeremy Chadwick writes: > On Fri, Oct 31, 2008 at 12:05:28PM -0400, Lowell Gilbert wrote: >> Jeremy Chadwick writes: >> >> > On Thu, Oct 30, 2008 at 06:34:31PM -0500, Jack Barnett wrote: >> >> >> >> Ok, I had some progress with this last night. Basically what I do is: >> >> >> >> in natd - redirect_port 1000 to 10000 to the internal windows box. >> >> set ipfw to "open" file wall. >> >> >> >> Obviously this isn't prefect - but gives some idea of what's going on. >> >> >> >> What I'd like to do, is a) keep the nat redirects since that works >> >> pretty well. >> >> b) in ipfw, ONLY allow data back on these ports IF the windows box has >> >> established the connection out first then deny everything else. >> > >> > This is called "port triggering" in the residential router world. I >> > don't know how to do this on FreeBSD. >> >> Stateful rules are the only way to do it. >> In fact, this is the main purpose of stateful rules. > > Read this part of the thread, where I outline protocol flow (based on > what the OP has stated about the protocol, which so far appears to be > accurate): > > http://lists.freebsd.org/pipermail/freebsd-questions/2008-October/thread.html > > Stateful rules will not solve this problem. > > The OP wants a feature that tells ipfw or pf "after the TCP handshake > has completed, dynamically add a port forward for port X on interface Y > to machine A on port Z; when the TCP session is FIN'd cleanly, or > extinguishes, dynamically remove that port forward". Okay, I guess I'm a little confused by the line about "ONLY allow data back on these ports IF the windows box has established the connection out first then deny everything else." I read that as saying that the Windows box had sent a packet on the same connection (4-tuple, at least) that should be later accepted heading *to* the Windows box. That's just a stateful rule, and it seems to be at odds with what you wrote in your first message in the thread. The apparent disagreement was why I said anything in the first place; it sounds like there's more than one model of how the game works. -- Lowell Gilbert, embedded/networking software engineer, Boston area http://be-well.ilk.org/~lowell/