From owner-freebsd-questions Fri Nov 17 11: 4:30 2000 Delivered-To: freebsd-questions@freebsd.org Received: from post.mail.nl.demon.net (post-11.mail.nl.demon.net [194.159.73.21]) by hub.freebsd.org (Postfix) with ESMTP id 20AD137B479; Fri, 17 Nov 2000 11:04:27 -0800 (PST) Received: from [212.238.15.212] (helo=grand.canyon.demon.nl) by post.mail.nl.demon.net with smtp (Exim 3.14 #4) id 13wqoD-0006ej-00; Fri, 17 Nov 2000 19:04:26 +0000 Received: by grand.canyon.demon.nl (Postfix, from userid 1000) id 2F0FC20B2; Fri, 17 Nov 2000 20:04:25 +0100 (CET) Date: Fri, 17 Nov 2000 20:04:25 +0100 From: Rene de Vries To: freebsd-questions@freebsd.org Cc: Ruslan Ermilov Subject: statefull packet filter together with natd question Message-ID: <20001117200425.A894@canyon.demon.nl> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline User-Agent: Mutt/1.2.5i Sender: owner-freebsd-questions@FreeBSD.ORG Precedence: bulk X-Loop: FreeBSD.ORG Hello, Currently I'm trying to move towards a statefull packet filter. When testing without nat all seems to work fine. But when I added natd (as the first rule) packets that were natd-ed on their way out had their return traffic blocked. The question is, what am I doing wrong?!? I hope somebody can tell me how to solve this problem. Rene from my logs: ipfw: Accept TCP 212.238.x.x:1026 x.x.x.x:23 out via isp0 ipfw: Deny TCP x.x.x.x:23 192.168.1.3:1026 in via isp0 ipfw rules: /sbin/ipfw -f flush /sbin/ipfw -q add divert natd all from any to any via isp0 /sbin/ipfw -q add allow all from any to any via lo0 /sbin/ipfw -q add allow all from any to any via dc0 /sbin/ipfw -q add check-state from any to any via isp0 /sbin/ipfw -q add deny log tcp from any to any established /sbin/ipfw -q add allow all from any to any out via isp0 keep-state /sbin/ipfw -q add deny log all from any to any -- Rene de Vries http://www.tcja.nl mailto:rene@tcja.nl To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-questions" in the body of the message