From owner-freebsd-questions Fri Mar 19 22:58:26 1999 Delivered-To: freebsd-questions@freebsd.org Received: from mta2-rme.xtra.co.nz (mta.xtra.co.nz [203.96.92.3]) by hub.freebsd.org (Postfix) with ESMTP id 9B4AB14FB0 for ; Fri, 19 Mar 1999 22:58:21 -0800 (PST) (envelope-from junkmale@pop3.xtra.co.nz) Received: from wocker ([210.55.164.76]) by mta2-rme.xtra.co.nz (InterMail v04.00.02.07 201-227-108) with SMTP id <19990320065929.NGCA3226200.mta2-rme@wocker>; Sat, 20 Mar 1999 19:59:29 +1300 From: "Dan Langille" Organization: The FreeBSD Diary To: "Jeff Yeo" Date: Sat, 20 Mar 1999 19:58:25 +1300 MIME-Version: 1.0 Content-type: text/plain; charset=US-ASCII Content-transfer-encoding: 7BIT Subject: Re: ipfw rule blocking connection Reply-To: junkmale@xtra.co.nz Cc: freebsd-questions@FreeBSD.ORG In-reply-to: <012901be7298$a17be780$0a64a8c0@upstairs.gvsa1.bc.wave.home.com> X-mailer: Pegasus Mail for Win32 (v3.01d) Message-Id: <19990320065929.NGCA3226200.mta2-rme@wocker> Sender: owner-freebsd-questions@FreeBSD.ORG Precedence: bulk X-Loop: FreeBSD.ORG On 19 Mar 99, at 22:11, Jeff Yeo wrote: > BTW, it isn't the "from 192.168.0.0/16 to any via ${oif}" rule that is > causing me > problems, it is the "from any to 192.168.0.0/16 via ${oif}" rule. I not 100% sure, but I think I had the same problem. I solved it by using ipfilter instead. I now prefer it to the natd/ipfw configuration. ipfilter is a transparent packet filter and does nat. See http://coombs.anu.edu.au/ipfilter/ for details on that. I have articles on ipfilter and it's installation/configuration on my site. I can give you sample rules if you want. > > I thought of moving the rule order, and tried moving the offending rule > before the natd rule in /etc/rc.firewall. The blocking rule: > 00050 deny ip from any to 192.168.0.0/16 via ${oif} > > was first in the list and the natd rule: > 00100 divert natd ip from any to any via ${oif} > > was second in the list. Incoming packets were still blocked. I used > tcpdump to look at the traffic on my external interface, and not a > 192.168.x.x > to be seen in either direction. Hence my consternation. This really does sound familiar. -- Dan Langille The FreeBSD Diary http://www.FreeBSDDiary.com/freebsd To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-questions" in the body of the message