From owner-freebsd-net@FreeBSD.ORG Sun Oct 19 09:06:05 2003 Return-Path: Delivered-To: freebsd-net@freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id 36ABB16A4B3 for ; Sun, 19 Oct 2003 09:06:05 -0700 (PDT) Received: from mta03-svc.ntlworld.com (mta03-svc.ntlworld.com [62.253.162.43]) by mx1.FreeBSD.org (Postfix) with ESMTP id F211F43FAF for ; Sun, 19 Oct 2003 09:06:03 -0700 (PDT) (envelope-from dan@ntlbusiness.com) Received: from cpc3-ches1-4-0-cust213.lutn.cable.ntl.com ([213.105.213.213]) by mta03-svc.ntlworld.comESMTP <20031019160601.DAMO6394.mta03-svc.ntlworld.com@cpc3-ches1-4-0-cust213.lutn.cable.ntl.com>; Sun, 19 Oct 2003 17:06:01 +0100 From: Dan To: Barney Wolff Date: Sun, 19 Oct 2003 17:04:42 +0100 User-Agent: KMail/1.5 References: <200310191532.40136.dan@ntlbusiness.com> <20031019155913.GA46989@pit.databus.com> In-Reply-To: <20031019155913.GA46989@pit.databus.com> MIME-Version: 1.0 Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: 7bit Content-Disposition: inline Message-Id: <200310191704.42446.dan@ntlbusiness.com> cc: freebsd-net@freebsd.org Subject: Re: IPFW. X-BeenThere: freebsd-net@freebsd.org X-Mailman-Version: 2.1.1 Precedence: list List-Id: Networking and TCP/IP with FreeBSD List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 19 Oct 2003 16:06:05 -0000 On Sunday 19 October 2003 4:59 pm, you wrote: > On Sun, Oct 19, 2003 at 03:32:40PM +0100, Dan wrote: > > Hi there. > > I hope you can help. > > I've been trying and trying for days to try and get these rules sorted, > > as whenever they're used, my laptop (which is using my FreeBSD box as a > > gateway) cannot access the Internet. > > I suggest you put "log" on all your denies, and by ipfw -atde list > see which rules are stopping the packets. > > Aside from whether the ruleset works, it seems inconsistent. If you're > going to keep state, you should not be allowing tcp established, but > instead setting up state on setup, both ways. btw, "pass" means allow, > did you mean "deny"? Hi there. Thank you very much for your reply. I couldn't see anything obvious in ipfw -atde list - and I tried requestnig a new page from the laptop, but saw nothing new there. I've taken what you said -- and as far as I can understand (sorry..this is really hard to me) I've come up with: Is this better? thanks again! # Define the firewall command (as in /etc/rc.firewall) for easy # reference. Helps to make it easier to read. fwcmd="/sbin/ipfw" # Force a flushing of the current rules before we reload. $fwcmd -f flush # Divert all packets through the tunnel interface. $fwcmd add 50 divert natd all from any to any via sis0 # Allow all connections that have dynamic rules built for them, # but deny established connections that don't have a dynamic rule. # See ipfw(8) for details. $fwcmd add check-state $fwcmd add pass tcp from any to any keep-state # Allow all localhost connections ${fwcmd} add 100 pass all from any to any via lo0 ${fwcmd} add 200 deny log all from any to 127.0.0.0/8 ${fwcmd} add 300 deny log ip from 127.0.0.0/8 to any # Allow all connections from my network card that I initiate $fwcmd add allow tcp from me to any out xmit any setup keep-state $fwcmd add deny log tcp from me to any $fwcmd add allow ip from me to any out xmit any keep-state $fwcmd add allow all from 192.168.0.0/24 to any # Everyone on the Internet is allowed to connect to the following # services on the machine. This example specifically allows connections # to sshd and a webserver. $fwcmd add allow tcp from any to any keep-state $fwcmd add allow tcp from any to me 80 setup $fwcmd add allow tcp from any to me 22 setup # This sends a RESET to all ident packets. $fwcmd add reset log tcp from any to me 113 in recv any # Enable ICMP: remove type 8 if you don't want your host to be pingable $fwcmd add allow icmp from any to any icmptypes 0,3,8,11,12,13,14 # Deny all the rest. $fwcmd add deny log ip from any to any