From owner-freebsd-questions Thu Jul 6 17:10:40 2000 Delivered-To: freebsd-questions@freebsd.org Received: from mail.monochrome.org (monochrome.org [206.64.112.124]) by hub.freebsd.org (Postfix) with ESMTP id 7DDDF37BB70 for ; Thu, 6 Jul 2000 17:10:29 -0700 (PDT) (envelope-from chris@monochrome.org) Received: from localhost (faro [192.168.1.7]) by mail.monochrome.org (8.9.3/8.9.3) with SMTP id UAA56452; Thu, 6 Jul 2000 20:10:19 -0400 (EDT) (envelope-from chris@monochrome.org) Date: Thu, 6 Jul 2000 20:10:19 -0400 (EDT) From: Chris Hill X-Sender: chris@localhost Reply-To: Chris Hill To: Jens Sauer Cc: freebsd-questions@FreeBSD.ORG Subject: Re: IPFW-question In-Reply-To: <20000706235327.C80FB37BA3B@hub.freebsd.org> Message-ID: MIME-Version: 1.0 Content-Type: TEXT/PLAIN; charset=US-ASCII Sender: owner-freebsd-questions@FreeBSD.ORG Precedence: bulk X-Loop: FreeBSD.ORG On Fri, 7 Jul 2000, Jens Sauer wrote: > i am using ipfw for the very first time and have the following problem: > > i configured my kernel with FIREWALL- and IPDIVERT-support fot NATD, > because of my private-address-clients. > >my rc.conf looks that way: [snip] You don't mention your firewall_type="SOMETHING" # Firewall type (see /etc/rc.firewall) line; can we assume it's set to "simple"? > my isdn-interface ISP0 is working fine, when i ping the internet from > the firewall, it dials, all ok. > > but when i traceroute into the internet from a LAN-client (192.168.0.x), > the isdn-card on the firewall is successfully dialing (interface is up), > but the packets are only going up to the network-card on the firewall, > then i get a timeout. [snip] I had a very similar problem, and was tearing my hair out for a long time over it. It turns out that the "simple" firewall setup assumes that you have real IP addresses on the _inside_, but you and I are running RFC1918 nets on the inside. What you need to do is edit /etc/rc.firewall. Comment out the lines $fwcmd add deny all from 192.168.0.0:255.255.0.0 to any via ${oif} $fwcmd add deny all from any to 192.168.0.0:255.255.0.0 via ${oif} Then, as root, type 'shutdown now' (without quotes), then return when it asks you for a shell, then at the # prompt you can either hit Ctrl-D or type 'exit' (without the quotes). This may not be the correct way to do it, but it did the trick for me. > Please help a bloody newbie :-) Hope it was of some use. -- Chris Hill chris@monochrome.org [1] Bus error netscape To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-questions" in the body of the message