Date: Sat, 20 Mar 1999 19:58:25 +1300 From: "Dan Langille" <junkmale@xtra.co.nz> To: "Jeff Yeo" <j.yeo@attcanada.net> Cc: freebsd-questions@FreeBSD.ORG Subject: Re: ipfw rule blocking connection Message-ID: <19990320065929.NGCA3226200.mta2-rme@wocker> In-Reply-To: <012901be7298$a17be780$0a64a8c0@upstairs.gvsa1.bc.wave.home.com>
next in thread | previous in thread | raw e-mail | index | archive | help
On 19 Mar 99, at 22:11, Jeff Yeo wrote:
> BTW, it isn't the "from 192.168.0.0/16 to any via ${oif}" rule that is
> causing me
> problems, it is the "from any to 192.168.0.0/16 via ${oif}" rule.
I not 100% sure, but I think I had the same problem. I solved it by using
ipfilter instead. I now prefer it to the natd/ipfw configuration.
ipfilter is a transparent packet filter and does nat. See
http://coombs.anu.edu.au/ipfilter/ for details on that. I have articles
on ipfilter and it's installation/configuration on my site. I can give
you sample rules if you want.
>
> I thought of moving the rule order, and tried moving the offending rule
> before the natd rule in /etc/rc.firewall. The blocking rule:
> 00050 deny ip from any to 192.168.0.0/16 via ${oif}
>
> was first in the list and the natd rule:
> 00100 divert natd ip from any to any via ${oif}
>
> was second in the list. Incoming packets were still blocked. I used
> tcpdump to look at the traffic on my external interface, and not a
> 192.168.x.x
> to be seen in either direction. Hence my consternation.
This really does sound familiar.
--
Dan Langille
The FreeBSD Diary
http://www.FreeBSDDiary.com/freebsd
To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-questions" in the body of the message
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?19990320065929.NGCA3226200.mta2-rme>