Date: Fri, 17 Nov 2000 20:04:25 +0100 From: Rene de Vries <rene@canyon.demon.nl> To: freebsd-questions@freebsd.org Cc: Ruslan Ermilov <ru@freebsd.org> Subject: statefull packet filter together with natd question Message-ID: <20001117200425.A894@canyon.demon.nl>
next in thread | raw e-mail | index | archive | help
Hello, Currently I'm trying to move towards a statefull packet filter. When testing without nat all seems to work fine. But when I added natd (as the first rule) packets that were natd-ed on their way out had their return traffic blocked. The question is, what am I doing wrong?!? I hope somebody can tell me how to solve this problem. Rene from my logs: ipfw: Accept TCP 212.238.x.x:1026 x.x.x.x:23 out via isp0 ipfw: Deny TCP x.x.x.x:23 192.168.1.3:1026 in via isp0 ipfw rules: /sbin/ipfw -f flush /sbin/ipfw -q add divert natd all from any to any via isp0 /sbin/ipfw -q add allow all from any to any via lo0 /sbin/ipfw -q add allow all from any to any via dc0 /sbin/ipfw -q add check-state from any to any via isp0 /sbin/ipfw -q add deny log tcp from any to any established /sbin/ipfw -q add allow all from any to any out via isp0 keep-state /sbin/ipfw -q add deny log all from any to any -- Rene de Vries http://www.tcja.nl mailto:rene@tcja.nl To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-questions" in the body of the message
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20001117200425.A894>