From owner-freebsd-isp  Mon Dec  4  0:35:53 2000
From owner-freebsd-isp@FreeBSD.ORG  Mon Dec  4 00:35:51 2000
Return-Path: <owner-freebsd-isp@FreeBSD.ORG>
Delivered-To: freebsd-isp@freebsd.org
Received: from christel.heitec.net (christel.heitec.net [193.101.232.3])
	by hub.freebsd.org (Postfix) with ESMTP id 4099E37B400
	for <freebsd-isp@freebsd.org>; Mon,  4 Dec 2000 00:35:51 -0800 (PST)
Received: from tashi.admin.er.heitec.net (paladin.heitec.net [193.101.232.30])
	by christel.heitec.net (Postfix) with ESMTP id 0EFC3354813
	for <freebsd-isp@freebsd.org>; Mon,  4 Dec 2000 09:41:40 +0100 (CET)
Received: by tashi.admin.er.heitec.net (Postfix, from userid 1000)
	id 1D4BC1DE1; Mon,  4 Dec 2000 09:37:29 +0100 (CET)
Date: Mon, 4 Dec 2000 09:37:29 +0100
To: freebsd-isp@freebsd.org
Subject: Re: client firewall with 2 ethernet ports
Message-ID: <20001204093729.L793@heitec.net>
Mail-Followup-To: freebsd-isp@freebsd.org
References: <XFMail.001201134446.nicole@unixgirl.com>
Mime-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
User-Agent: Mutt/1.2.5i
In-Reply-To: <XFMail.001201134446.nicole@unixgirl.com>; from nicole@unixgirl.com on Fri, Dec 01, 2000 at 13:44:46 -0700
Organization: Heitec AG
From: lenz@heitec.net (Lenz Gschwendtner)
Sender: owner-freebsd-isp@FreeBSD.ORG
Precedence: bulk
X-Loop: FreeBSD.org

Hi Nicole,

On Fri, 01 Dec 2000, Nicole wrote:

>  How do I setup rules that apply to one port and not the other?
>  Would I use a modified form of the simple rules?

there are several methods:

first you can simply define the traffic by direction and interface in
statements like:
$fwcmd add deny log all from ${inet} to any in recv ${oif}
$fwcmd add pass log all from ${inet} to any out xmit ${oif}

whereas you define $oif to the outside interface:
oif="de0"

or you simply define a interface without direction in a statement like
this (in a nat config file):
$fwcmd add divert natd all from any to any via ${natd_interface}

for better understanding of the firewall script it is preferrable to
include the direction in which the rule works (out xmit/in recv)

cheers
    lenz
--
 (__)          eat penguins instead, they start to
 (++)-----i\   spread around anyway!
  ~~| BSE | *
    |_|~|_|    FreeBSD Systemadministrator


To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-isp" in the body of the message