From owner-freebsd-questions@FreeBSD.ORG Mon Jul 18 03:18:36 2005 Return-Path: X-Original-To: freebsd-questions@freebsd.org Delivered-To: freebsd-questions@freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id EF59D16A41C for ; Mon, 18 Jul 2005 03:18:36 +0000 (GMT) (envelope-from jim-c@charter.net) Received: from mxsf34.cluster1.charter.net (mxsf34.cluster1.charter.net [209.225.28.159]) by mx1.FreeBSD.org (Postfix) with ESMTP id 8560343D46 for ; Mon, 18 Jul 2005 03:18:36 +0000 (GMT) (envelope-from jim-c@charter.net) Received: from mxip05a.cluster1.charter.net (mxip05a.cluster1.charter.net [209.225.28.135]) by mxsf34.cluster1.charter.net (8.12.11/8.12.11) with ESMTP id j6I3IZAC025309 for ; Sun, 17 Jul 2005 23:18:35 -0400 Received: from 68-119-202-215.dhcp.spbg.sc.charter.com (HELO [127.0.0.1]) (68.119.202.215) by mxip05a.cluster1.charter.net with ESMTP; 17 Jul 2005 23:18:37 -0400 X-IronPort-AV: i="3.93,296,1115006400"; d="scan'208"; a="1176378599:sNHT16500238" Message-ID: <42DB1F87.3030206@charter.net> Date: Sun, 17 Jul 2005 23:18:31 -0400 From: Jim Campbell User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.7.2) Gecko/20040804 Netscape/7.2 (ax) X-Accept-Language: en-us, en MIME-Version: 1.0 To: freebsd-questions@freebsd.org Content-Type: text/plain; charset=us-ascii; format=flowed Content-Transfer-Encoding: 7bit Subject: Newbie IPFW Questions X-BeenThere: freebsd-questions@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: User questions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 18 Jul 2005 03:18:37 -0000 I have a machine set up as a classroom to learn about FreeBSD. It is running 4.11 primarily because anything later can't see my hard drive. As background, my FBSD machine has an address of 192.168.1.110. It is situated behind a hardware firewall (a Linksys router). $pif is vr0. I'm having problems setting up IPFW to communicate with an Onion router. The puzzling part is that I am able to use the Onion router but my /var/log/security file says that some of the packets are being dropped. Following is what I hope are the pertinent lines from my /etc/ipfw.rules file: $cmd 00225 allow tcp from me to any 9001-9033 out via $pif setup keep-state $cmd 00299 deny log all from me to any out via $pif $cmd 00332 deny log tcp from any to me established in via $pif Next is an excerpt from the /var/log/security file: Jul 17 21:49:58 JimsP1G /kernel: ipfw: 299 Deny TCP 192.168.1.110:2218 128.148.34.133:9001 out via vr0 Jul 17 21:49:59 JimsP1G /kernel: ipfw: 299 Deny TCP 192.168.1.110:4959 131.175.189.134:9001 out via vr0 Jul 17 21:50:18 JimsP1G /kernel: ipfw: 332 Deny TCP 128.148.34.133:9001 192.168.1.110:2218 in via vr0 Jul 17 21:50:29 JimsP1G /kernel: ipfw: 332 Deny TCP 131.175.189.134:9030 192.168.1.110:4566 in via vr0 Now my questions. First, why isn't rule 225 allowing all the packets out to the Onion router? It seems to me that ipfw should allow all packets in the port range 9001-9033 out or none. Next, the two inbound packets should be returning in response to an outbound packet. Why are they being dropped? Are they exceeding some timeout? Thanks in advance. Jim Campbell