From owner-freebsd-questions Fri Mar 7 11:36: 5 2003 Delivered-To: freebsd-questions@freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id 9B6DC37B405 for ; Fri, 7 Mar 2003 11:36:03 -0800 (PST) Received: from rwcrmhc53.attbi.com (rwcrmhc53.attbi.com [204.127.198.39]) by mx1.FreeBSD.org (Postfix) with ESMTP id 1B75843F3F for ; Fri, 7 Mar 2003 11:36:00 -0800 (PST) (envelope-from freebsd-questions-local@be-well.no-ip.com) Received: from be-well.ilk.org (lowellg.ne.client2.attbi.com[24.147.188.198]) by rwcrmhc53.attbi.com (rwcrmhc53) with ESMTP id <20030307193559053007u2c4e>; Fri, 7 Mar 2003 19:35:59 +0000 Received: from be-well.ilk.org (lowellg.ne.client2.attbi.com [24.147.188.198] (may be forged)) by be-well.ilk.org (8.12.8/8.12.7) with ESMTP id h27JZwBc046134 for ; Fri, 7 Mar 2003 14:35:58 -0500 (EST) (envelope-from freebsd-questions-local@be-well.no-ip.com) Received: (from lowell@localhost) by be-well.ilk.org (8.12.8/8.12.6/Submit) id h27JZwhb046131; Fri, 7 Mar 2003 14:35:58 -0500 (EST) X-Authentication-Warning: be-well.ilk.org: lowell set sender to freebsd-questions-local@be-well.ilk.org using -f To: freebsd-questions@freebsd.org Subject: Re: firewall References: From: Lowell Gilbert Date: 07 Mar 2003 14:35:58 -0500 In-Reply-To: Message-ID: <44y93r9dgh.fsf@be-well.ilk.org> Lines: 49 User-Agent: Gnus/5.09 (Gnus v5.9.0) Emacs/21.2 MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Sender: owner-freebsd-questions@FreeBSD.ORG Precedence: bulk List-ID: List-Archive: (Web Archive) List-Help: (List Instructions) List-Subscribe: List-Unsubscribe: X-Loop: FreeBSD.ORG "Brian Henning" writes: > Hello- > I am pretty new to natd and ipfw, so i would like to be able to describe what i > want > to be able to do with my new bsd router. This is to understand the nomenclature > and how understand > > how other people use bsd as a router/firewall. > So far i have manually done this to my router. > > >sysctl net.inet.ip.forwarding=1 # gateway_enable="YES" > >natd -interface rl1 > >ipfw -f flush > >ipfw add divert natd all from any to any via rl1 > >ipfw add pass all from any to any > > notes: > r11 is my external network > rl0 is my internal network > > here is what i would like to do in a more standard way. Please correct my > wording > if it is off or if it unclear. > > port forward: ssh from a local machine port 22 to the router port 22, open to > the outside Being able to connect out is easy, but I think you should have that already. Supporting incoming connections the same way doesn't make sense, because the router won't know which local machine should get it. > port forward: vpn port 5001 for all local machines, open to the outside You need to work out your topology, and probably not run VPN software on each local machine, but implement a tunnel that they can route to. > block all servers on the router to the outside, but not the inside > anyone on the local network has access to services on the router That's pretty normal; you just put an allow-all clause on the inside interface. > what else should i consider? Reading Cheswick & Bellovin, perhaps? > is port forwarding done with ip or with mac address? IP. To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-questions" in the body of the message