From owner-freebsd-questions Sat Apr 7 0:45:27 2001 Delivered-To: freebsd-questions@freebsd.org Received: from cody.jharris.com (cody.jharris.com [205.238.128.83]) by hub.freebsd.org (Postfix) with ESMTP id 9B50337B424 for ; Sat, 7 Apr 2001 00:45:22 -0700 (PDT) (envelope-from nick@rogness.net) Received: from localhost (nick@localhost) by cody.jharris.com (8.11.1/8.9.3) with ESMTP id f378nQ322062; Sat, 7 Apr 2001 03:49:26 -0500 (CDT) (envelope-from nick@rogness.net) Date: Sat, 7 Apr 2001 03:49:26 -0500 (CDT) From: Nick Rogness X-Sender: nick@cody.jharris.com To: Trevin Chow Cc: freebsd-questions@FreeBSD.ORG Subject: Re: Natd - "failed to write packet back" In-Reply-To: Message-ID: MIME-Version: 1.0 Content-Type: TEXT/PLAIN; charset=US-ASCII Sender: owner-freebsd-questions@FreeBSD.ORG Precedence: bulk X-Loop: FreeBSD.ORG On Sat, 7 Apr 2001, Trevin Chow wrote: > On Sat, 7 Apr 2001, Nick Rogness wrote: > > Do a `ipfw -a l` and send it. > > 00100 0 0 allow ip from any to any via lo0 > 00200 0 0 deny ip from any to 127.0.0.0/8 > 00300 0 0 deny log logamount 100 ip from 192.168.0.0/16 to any in recv fxp0 > 00400 0 0 deny log logamount 100 ip from 192.168.0.0/16 to any in recv fxp0 > 00500 0 0 deny log logamount 100 ip from 172.16.0.0/12 to any in recv fxp0 > 00600 0 0 deny log logamount 100 ip from 10.0.0.0/8 to any in recv fxp0 > 00700 0 0 deny log logamount 100 ip from any to 192.168.0.0/16 in recv fxp0 > 00800 0 0 deny log logamount 100 ip from any to 172.16.0.0/12 in recv fxp0 > 00900 0 0 deny log logamount 100 ip from any to 10.0.0.0/8 in recv fxp0 > 01000 0 0 deny ip from 0.0.0.0/8 to any in recv fxp0 > 01100 0 0 deny ip from 169.254.0.0/16 to any in recv fxp0 > 01200 0 0 deny ip from 192.0.2.0/24 to any in recv fxp0 > 01300 0 0 deny ip from 224.0.0.0/4 to any in recv fxp0 > 01400 0 0 deny ip from 240.0.0.0/4 to any in recv fxp0 > 01500 0 0 deny ip from any to 0.0.0.0/8 in recv fxp0 > 01600 0 0 deny ip from any to 169.254.0.0/16 in recv fxp0 > 01700 0 0 deny ip from any to 192.0.2.0/24 in recv fxp0 > 01800 1 28 deny ip from any to 224.0.0.0/4 in recv fxp0 > 01900 0 0 deny ip from any to 240.0.0.0/4 in recv fxp0 > 02000 0 0 divert 8668 ip from any to any via fxp0 > 02100 0 0 allow tcp from any to any established > 02200 0 0 allow ip from any to any via fxp1 > 02300 0 0 allow tcp from any to any in recv fxp0 established > 02400 0 0 allow tcp from 142.58.0.0/16 to 2626 setup > 02500 0 0 allow tcp from 142.58.101.25 to 2626 setup > 02600 0 0 allow tcp from 209.53.63.29 to 2626 setup > 02700 0 0 allow log logamount 100 tcp from 142.58.101.25 to 2627 in recv fxp0 setup > 02800 0 0 allow log logamount 100 tcp from 24.71.46.74 to 2627 in recv fxp0 setup > 02900 0 0 allow log logamount 100 tcp from 209.53.63.29 to 2627 in recv fxp0 setup > 03000 0 0 allow log logamount 100 tcp from 24.113.38.121 to 2627 in recv fxp0 setup > 03100 0 0 allow tcp from any to 80 setup > 03200 0 0 allow tcp from any to 443 setup > 03300 0 0 allow tcp from any to 25 setup > 03400 0 0 allow tcp from 192.168.0.0/16 to 143 setup > 03500 0 0 allow tcp from 142.58.101.25 to 143 setup > 03600 0 0 allow tcp from 209.53.63.29 to 143 setup > 03700 0 0 allow udp from any to 53 > 03800 0 0 allow udp from 53 to any > 03900 0 0 allow tcp from any to 53 setup > 04000 0 0 allow tcp from any to any 113 > 04100 0 0 allow log logamount 100 tcp from 209.53.63.29 to 1241 > 04200 0 0 allow icmp from any to any via fxp1 > 04300 0 0 allow icmp from any to any in recv fxp0 icmptype 0 > 04400 0 0 allow icmp from any to any out xmit fxp0 icmptype 8 > 04500 0 0 allow icmp from any to any in recv fxp0 icmptype 3,11 > 04600 0 0 allow icmp from any to any via fxp0 icmptype 3,4,11,12 > 65532 0 0 deny log logamount 100 tcp from any to any in recv fxp0 setup > 65533 0 0 deny icmp from any to any > 65534 0 0 deny log logamount 100 ip from any to any > 65535 2 390 deny ip from any to any ^^^^^ Rule 65535 is denying your packets...You are not allowing valid traffic...which is why you are getting a "permission denied". I would recommend running a allow log rule before it to see what valid traffic looks like...then do your filtering after you know for sure stuff works. Nick Rogness - Keep on Routing in a Free World... "FreeBSD: The Power to Serve!" To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-questions" in the body of the message