Date: Tue, 25 Jul 2000 17:34:08 -0600 From: Warner Losh <imp@village.org> To: Stephen Montgomery-Smith <stephen@math.missouri.edu> Cc: freebsd-security@FreeBSD.ORG Subject: Re: Problems with natd and simple firewall Message-ID: <200007252334.RAA24713@harmony.village.org> In-Reply-To: Your message of "Tue, 25 Jul 2000 03:04:22 CDT." <397D4A06.9CFAF1FA@math.missouri.edu> References: <397D4A06.9CFAF1FA@math.missouri.edu> <397C8F30.8DFCE0E9@math.missouri.edu>
next in thread | previous in thread | raw e-mail | index | archive | help
I don't think we need a special option. We have the following in our
firewall rules:
#
# filter_net
#
# Takes one or two arguments.
#
# This will filter out traffic to/from these networks. The first
# argument
# will be filtered. If there is a second argument, it is the
# interface to
# filter on
#
filter_net()
{
via=${2:+via $2}
$fwcmd add deny log ip from any to $1 ${via}
$fwcmd add deny log ip from $1 to any ${via}
}
inet_if=fxp0
filter_net 192.168.0.0:255.255.0.0
filter_net 172.16.0.0:255.240.0.0
filter_net 10.0.0.0:255.0.0.0 ${inet_if}
and this has been verified to work. we use net10 internally and we
need for the router that we have to be able to pass those packets
through the router, but not out to the internet, which is on fxp0.
Warner
To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-security" in the body of the message
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?200007252334.RAA24713>