Date: Fri, 17 Oct 2008 15:03:18 -0400 From: Chen Xu <xuchen@brandeis.edu> To: Christer Hermansson <mail@chdevelopment.se> Cc: freebsd-questions@freebsd.org Subject: Re: no access to web server behind ipfw Message-ID: <20081017190318.GC22709@brandeis.edu> In-Reply-To: <48F8DF53.9090506@chdevelopment.se> References: <184b087c0810141105o657af770l5d0535c19fab059d@mail.gmail.com> <48F8DF53.9090506@chdevelopment.se>
next in thread | previous in thread | raw e-mail | index | archive | help
Hi Christer, I followed the example from the handbook. Yes, it is OK to divert in and out separately. skipto is used to point to the divert out rule number when it is outbound. I run into problem only when with natd to redirect from gateway to local machine. tcpdump shows that packets of both directions are actually go through fine, but only head is there, body was ripped off. I am looking into OpenBSD's PF right now. It is such a simple goal to reach but seems not so easy. -Chen * Christer Hermansson <mail@chdevelopment.se> [081017 14:54]: > Chen Xu wrote: > > $cmd 100 divert natd ip from any to any in via $pif > > $cmd 101 check-state > > > > > > > You use "in via $pif", I'm not 100% sure but I think you should only use > "via $pif". > > # Authorized inbound packets > > $cmd 421 allow tcp from any to 192.168.1.10 80 in via $pif setup limit > > src-addr 5 > > > > > > > I think it's bad to use statefull rules for inbound connections. > > -- > > Christer Hermansson > > http://www.chdevelopment.se > >
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20081017190318.GC22709>