From owner-freebsd-questions Wed Sep 26 0:38:46 2001 Delivered-To: freebsd-questions@freebsd.org Received: from magnia.corridor.net (ns.corridor.net [66.100.224.8]) by hub.freebsd.org (Postfix) with ESMTP id 3200637B413 for ; Wed, 26 Sep 2001 00:38:34 -0700 (PDT) Received: from lightstep.org (unverified [66.100.232.202]) by magnia.corridor.net (Vircom SMTPRS 5.0.194) with SMTP id ; Wed, 26 Sep 2001 02:37:56 -0500 Received: by lightstep.org (Postfix, from userid 1000) id D4B01243A3; Wed, 26 Sep 2001 02:41:19 -0500 (CDT) Received: from localhost (localhost [127.0.0.1]) by lightstep.org (Postfix) with ESMTP id 9079F16E9B; Wed, 26 Sep 2001 02:41:19 -0500 (CDT) Date: Wed, 26 Sep 2001 02:41:19 -0500 (CDT) From: Bradley Oedithipus To: Nick Rogness Cc: Subject: Re: natd/ipfw/sshd problem. In-Reply-To: Message-ID: MIME-Version: 1.0 Content-Type: TEXT/PLAIN; charset=US-ASCII Sender: owner-freebsd-questions@FreeBSD.ORG Precedence: bulk List-ID: List-Archive: (Web Archive) List-Help: (List Instructions) List-Subscribe: List-Unsubscribe: X-Loop: FreeBSD.ORG Yes, everything works, whatever the ipfw rules are.. EXCEPT ssh... weird huh? bradley@lightstep.org On Tue, 25 Sep 2001, Nick Rogness wrote: > On Tue, 25 Sep 2001, Bradley Oedithipus wrote: > > [snip] > > lightstep:~ # ipfw -a l > > 00050 1933 595146 divert 8668 ip from any to any via ed0 > > 00100 19894 995402 allow ip from any to any via lo0 > > 00200 0 0 deny ip from any to 127.0.0.0/8 > > 00250 108 6213 allow tcp from 10.0.0.0/8 to 66.100.232.202 143 > > 00300 23 1260 unreach host tcp from any to 66.100.232.202 143 > > 00500 17 972 unreach host tcp from any to 66.100.232.202 139 > > 65000 40851 7434737 allow ip from any to any > > 65535 27 1801 deny ip from any to any > > lightstep:~ # > > > > I have no options passed to natd Yes, natd is running. Yes, I can > > access everything from the inside to the outside regardless of the > > ipfw rules (must be open tho) BUT, in order to access the outside from > > the subnet (not the server) the divert rule shown above MUST be in > > place exactly as it is. That is why i dont think that i am blocking > > ports. If i was blocking port 22, nmap (from a remote machine) would > > at least show that port 22 was being filtered. But it doesnt, it > > doesnt show it at all. > > This is a tad wierd. Does ftp or telnet or anything else work > from the outside. > > Nick Rogness > - Keep on Routing in a Free World... > "FreeBSD: The Power to Serve!" > > To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-questions" in the body of the message