From owner-freebsd-questions@FreeBSD.ORG Sat May 3 16:07:23 2003 Return-Path: Delivered-To: freebsd-questions@freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id E25B337B401 for ; Sat, 3 May 2003 16:07:23 -0700 (PDT) Received: from s1.home.ro (home.rdsnet.ro [193.231.236.40]) by mx1.FreeBSD.org (Postfix) with SMTP id 0783643FAF for ; Sat, 3 May 2003 16:07:22 -0700 (PDT) (envelope-from bsdwave@go.ro) Received: (qmail 15858 invoked from network); 3 May 2003 23:07:08 -0000 Received: from unknown (HELO free.bsd.org) (81.196.89.85) by s1.go.ro with SMTP; 3 May 2003 23:07:08 -0000 Date: Sun, 4 May 2003 02:08:43 +0300 From: Rapier To: freebsd-questions@freebsd.org Message-Id: <20030504020843.6a4fd568.bsdwave@go.ro> Organization: pG X-Mailer: Sylpheed version 0.8.10claws (GTK+ 1.2.10; i386-portbld-freebsd4.8) Mime-Version: 1.0 Content-Type: text/plain; charset=US-ASCII Content-Transfer-Encoding: 7bit Subject: ipfw problem X-BeenThere: freebsd-questions@freebsd.org X-Mailman-Version: 2.1.1 Precedence: list List-Id: User questions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 03 May 2003 23:07:24 -0000 Hello everyone, I have a small home network with 3 boxes behind a FreeBSD 4.7-RELEASE(natd).I had to allow outbound tcp 5200 from 192.168.0.3,and 5198,5199 udp outbound and inbound from the same box,did that with natd -redirect-port.Everything was fine when i had ipfw add allow ip from any to any.I put up a small firewall and cannot seem to figure it out why it ain't working(redirecting those 2 udp's).Nothing shows up denied in the firewall's log.The accounting to those 2 udp's remain 0.Something is messed in my firewall rulles,i need a little help please.Here is my firewall: ################################################################ 00100 436 20928 allow tcp from any to any 5200 via any 00110 0 0 allow udp from any to any 5198 via any 00120 0 0 allow udp from any to any 5199 via any 01000 0 0 deny log logamount 100 ip from 10.0.0.0/8 to any in recv rl0 01100 0 0 deny log logamount 100 ip from 172.16.0.0/12 to any in recv rl0 02000 6 240 allow ip from any to any via lo0 02100 0 0 deny log logamount 100 tcp from any to any in tcpflags fin,syn 02150 0 0 deny log logamount 100 ip from any to any in recv any frag 02200 3 132 reset tcp from any to any 113 02300 6452 5118652 divert 8668 ip from any to any via rl0 03000 0 0 allow icmp from any to any icmptype 3 03100 0 0 allow icmp from any to any icmptype 4 03200 0 0 allow icmp from any to any out icmptype 8 03300 0 0 allow icmp from any to any in icmptype 0 03400 0 0 allow icmp from any to any in icmptype 11 04000 0 0 check-state 04200 81 8934 deny log logamount 100 tcp from any to any in established 04300 67 11835 allow udp from 192.168.0.0/24 to any keep-state via rl1 04400 12506 10342918 allow tcp from 192.168.0.0/24 to any keep-state via rl1 setup 04500 30 2396 allow udp from 81.196.89.85 to any keep-state via rl0 04600 2818 117654 allow tcp from 81.196.89.85 to any keep-state via rl0 65000 26 1872 deny log logamount 1000 ip from any to any 65535 0 0 deny ip from any to any ################################################################ --------------------------------------------------- "Definitions of hardware and software for dummies: Hardware is what you kick; Software is what you curse."