Date: Thu, 18 Jan 2001 20:08:29 -0500 From: Bill Moran <wmoran@mail.iowna.com> To: Trevin Chow <tmchow@sfu.ca> Cc: questions@FreeBSD.ORG Subject: Re: NAT doesn't work with my firewall rules? Message-ID: <3A67938D.46D37CC6@mail.iowna.com> References: <5.0.2.1.2.20010118130802.02bfc808@mail.brightmail.com> <5.0.2.1.2.20010118151323.02be0e38@popserver.sfu.ca>
next in thread | previous in thread | raw e-mail | index | archive | help
Well ... I don't know what's wrong, but I have some suggestions ...
hopefully they'll help narrow things down:
First off, can you enable these rules and then do some things that don't
work before making a file of the "ipfw show" that will (hopefully)
indicate some "deny" rule that's catching them.
Trevin Chow wrote:
> Here's the full output of `ipfw show`:
>
> 00100 0 0 allow ip from any to any via lo0
> 00200 0 0 deny ip from any to 127.0.0.0/8
> 00300 26 1744 divert 8668 ip from any to any via dc0
^^ ^^^^
The divert appears to be working - but it could be losing the data
somewhere else.
> 00400 0 0 deny ip from 192.168.0.0/24 to any in recv dc0
> 00500 0 0 deny ip from 209.53.0.0/18 to any in recv fxp0
> 00600 0 0 deny ip from 209.53.0.0/18 to any in recv fxp1
> 00700 0 0 deny ip from 192.168.0.0/16 to any in recv dc0
OK, this rule and rule 00400 are almost the same, except the netmask is
different. Review what you're doing here, I think 00700 is correct.
> 00800 0 0 deny ip from 172.16.0.0/12 to any in recv dc0
> 00900 0 0 deny ip from 224.0.0.0/4 to any
> 01000 0 0 deny ip from 10.0.0.0/8 to any in recv dc0
> 01100 12 984 allow ip from any to any out xmit dc0
> 01200 0 0 allow ip from any to any via fxp0
> 01300 0 0 allow ip from any to any via fxp1
> 01400 14 760 allow tcp from any to any in recv dc0 established
This one could be the problem. try "pass tcp from any to any
established"
> 01500 0 0 allow tcp from 142.58.101.25 to 209.53.60.139 2626 setup
> 01600 0 0 allow tcp from 142.58.107.12 to 209.53.60.139 2626 setup
> 01700 0 0 allow log logamount 100 tcp from 142.58.101.25 to 209.53.60.139 2627 in recv dc0 setup
> 01800 0 0 allow log logamount 100 tcp from 142.58.107.12 to 209.53.60.139 2627 in recv dc0 setup
> 01900 0 0 allow log logamount 100 tcp from 24.71.46.74 to 209.53.60.139 2627 in recv dc0 setup
> 02000 0 0 allow log logamount 100 tcp from 209.53.63.29 to 209.53.60.139 2627 in recv dc0 setup
> 02100 0 0 allow log logamount 100 tcp from 24.113.38.121 to 209.53.60.139 2627 in recv dc0 setup
I don't know what 1500-2100 are about, but they should't be causing any
trouble since they're allowing anyway.
> 02200 0 0 allow tcp from any to 209.53.60.139 80 setup
> 02300 0 0 allow tcp from any to 209.53.60.139 25 setup
> 02400 0 0 allow tcp from 142.58.101.25 to 209.53.60.139 110 setup
> 02500 0 0 allow tcp from 24.113.77.121 to 209.53.60.139 110 setup
> 02600 0 0 allow udp from any 123 to 209.53.60.139
> 02700 0 0 allow udp from 209.53.60.139 to any 123
> 02800 0 0 allow udp from any to 209.53.60.139 53
> 02900 0 0 allow udp from 209.53.60.139 53 to any
> 03000 0 0 allow tcp from any to 209.53.60.139 53 setup
> 03100 0 0 allow tcp from any to 209.53.60.139 194
> 03200 0 0 allow udp from any to 209.53.60.139 194
> 03300 0 0 deny log logamount 100 tcp from any to any in recv dc0 setup
> 03400 0 0 allow icmp from any to any via fxp0
> 03500 0 0 allow icmp from any to any via fxp1
> 03600 0 0 allow icmp from any to any in recv dc0 icmptype 0
> 03700 0 0 allow icmp from any to any out xmit dc0 icmptype 8
> 03800 0 0 allow udp from any to any 33434-33523 out xmit dc0
> 03900 0 0 allow icmp from any to any via dc0 icmptype 3,4,11,12
> 65532 0 0 deny udp from any to any
> 65533 0 0 deny icmp from any to any
> 65534 0 0 deny log logamount 100 ip from any to any
> 65535 0 0 deny ip from any to any
I'm guessing that it's getting to the end and catching your packets on
the last few deny statements (BTW, 65532-65534 are superflous, 65535
will catch any packets that don't match a previous rule)
Wasn't much help, I now, but hopefully it will point you toward a
solution.
Good luck,
Bill
To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-questions" in the body of the message
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?3A67938D.46D37CC6>