From owner-freebsd-current@FreeBSD.ORG Tue Nov 28 18:36:34 2006 Return-Path: X-Original-To: current@freebsd.org Delivered-To: freebsd-current@FreeBSD.ORG Received: from mx1.FreeBSD.org (mx1.freebsd.org [69.147.83.52]) by hub.freebsd.org (Postfix) with ESMTP id A2E4316A407 for ; Tue, 28 Nov 2006 18:36:34 +0000 (UTC) (envelope-from julian@elischer.org) Received: from outV.internet-mail-service.net (outV.internet-mail-service.net [216.240.47.245]) by mx1.FreeBSD.org (Postfix) with ESMTP id 9136E43C9E for ; Tue, 28 Nov 2006 18:36:30 +0000 (GMT) (envelope-from julian@elischer.org) Received: from shell.idiom.com (HELO idiom.com) (216.240.47.20) by out.internet-mail-service.net (qpsmtpd/0.32) with ESMTP; Tue, 28 Nov 2006 10:23:33 -0800 Received: from [10.251.18.229] (nat.ironport.com [63.251.108.100]) by idiom.com (8.12.11/8.12.11) with ESMTP id kASIZpRs066472; Tue, 28 Nov 2006 10:35:51 -0800 (PST) (envelope-from julian@elischer.org) Message-ID: <456C817F.1020500@elischer.org> Date: Tue, 28 Nov 2006 10:35:43 -0800 From: Julian Elischer User-Agent: Thunderbird 1.5.0.8 (Macintosh/20061025) MIME-Version: 1.0 To: fulan Peng References: In-Reply-To: Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit Cc: current@freebsd.org Subject: Re: FreeBSD 6.1 and 6.2 i386 firewall or NAT block web mail applications X-BeenThere: freebsd-current@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Discussions about the use of FreeBSD-current List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 28 Nov 2006 18:36:34 -0000 fulan Peng wrote: > Hi, > I need some help with FreeBSD firewall with NAT. I have made pppoe and > NAT working with both 6.1 release and 6.2 RC i386. All I want is to > forward port 443 to port 8843. I added a line in the OPEN portion in > the rc.firewall file: > ${fwcmd} add fwd 127.0.0.1,8843 tcp from any to any 443 in keep-state how about: ${fwcmd} add fwd 127.0.0.1,8843 tcp from any to me 443 in keep-state (or specify the actual address you want to forward) > Now, when I type https://myserver's ip, it will forward to a proxy > server listening at 8843. This is good. But, in the local network, > nobody can access the yahoo and google mail. > I made another kernel with the options IPFIREWALL_DEFAULT_TO_ACCEPT. > When I ipfw, there is only one rule: > allow ip from any to any > This is good. > When I added a line > ipfw add fwd 127.0.0.1,8843 from any to any 443 in keep-state > again, it won't work with any web email applications. > I added a line like this > ${fwcmd} add pass tcp from any to any 25 setup > Still it won't work. > pen at both 6.1 and 6.2 are not working. I remember it works only with > 7.0-current. > I have only 3 options when I compile the kernel: > options IPFIREWALL > options IPFIREWALL_FORWARD > options IPDIVERT > > in order to get pppoe to work, I added > options NETGRAPH > options NETGRAPH_PPPOE > options NETGRAPH_SOCKET > > my rc.conf is like this > gateway_enable="YES" > hostname=... > ifconfig_ed0=... > ppp_enable="YES" > ppp_nat="YES" > ppp_profile="sympatico" > ppp_mode="ddial" > firewall_enable="YES" > firewall_type="OPEN" > > By the way, I have made this mistake twice: > Comment out firewall_enable and firewall_type, the default rule is to > lock out any body. I could not access my remote server. I wish you > would not do this like me. > The best way is to have an options IPFIREWALL_DEFAULT_TO_ACCEPT. The > problem is : whenever you add some rule, it will block web mails! > _______________________________________________ > freebsd-current@freebsd.org mailing list > http://lists.freebsd.org/mailman/listinfo/freebsd-current > To unsubscribe, send any mail to "freebsd-current-unsubscribe@freebsd.org"