From owner-freebsd-net Mon May 20 15:23:30 2002 Delivered-To: freebsd-net@freebsd.org Received: from exchange.corp.cre8.com (ns.cre8.com [216.135.81.2]) by hub.freebsd.org (Postfix) with ESMTP id BD79F37B406 for ; Mon, 20 May 2002 15:23:11 -0700 (PDT) Received: by exchange.corp.cre8.com with Internet Mail Service (5.5.2653.19) id ; Mon, 20 May 2002 18:23:20 -0400 Message-ID: <2F6DCE1EFAB3BC418B5C324F13934C96016C9B4C@exchange.corp.cre8.com> From: Scott Ullrich To: 'John Angelmo' , net@freebsd.org Subject: RE: "dynamic" ipfw Date: Mon, 20 May 2002 18:23:20 -0400 MIME-Version: 1.0 X-Mailer: Internet Mail Service (5.5.2653.19) Content-Type: multipart/alternative; boundary="----_=_NextPart_001_01C2004C.F2595350" Sender: owner-freebsd-net@FreeBSD.ORG Precedence: bulk List-ID: List-Archive: (Web Archive) List-Help: (List Instructions) List-Subscribe: List-Unsubscribe: X-Loop: FreeBSD.org This message is in MIME format. Since your mail reader does not understand this format, some or all of this message may not be legible. ------_=_NextPart_001_01C2004C.F2595350 Content-Type: text/plain; charset="iso-8859-1" Check out http://www.bsdshell.com 's EtherFirewall project. It will allow you to maintain Mac addresses with your IPFW rules. Now regarding the hostname to ip address conversion for firewall rules. I have a feeling it is translating the IP address at the time of entry so this is not really going to work for your round-robin situation. EtherFirewall is the clear choice for this. Good luck! -Scott > -----Original Message----- > From: John Angelmo [mailto:john@veidit.net] > Sent: Monday, May 20, 2002 1:40 PM > To: net@freebsd.org > Subject: "dynamic" ipfw > > > Hello > > I have a small problem with IPFW > > How can I handle adding and removing rules based on IP/MAC per user? > I can add a rule for a specific IP/MAC without the need to > flush but can > I remove it in the same way? > > now lets say I have a user that only needs access to it's mailserver > mail.user.com with pop3 and smtp > then the rule for pop3 would be something like > add allow ip from mail.user.com 110 to IP/HOST (MAC dosn't > work here right?) > > Now mail.user.com uses runrobin so the IP changes from request to > request but dosn't the IPFW resolve the IP when its added to > the rules, > how can this be solved for the user? > > /John > > > To Unsubscribe: send mail to majordomo@FreeBSD.org > with "unsubscribe freebsd-net" in the body of the message > ------_=_NextPart_001_01C2004C.F2595350 Content-Type: text/html; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable RE: "dynamic" ipfw

Check out http://www.bsdshell.com 's EtherFirewall = project.   It will allow you to maintain Mac addresses with = your IPFW rules. 

Now regarding the hostname to ip address conversion = for firewall rules.  I have a feeling it is translating the IP = address at the time of entry so this is not really going to work for = your round-robin situation.  EtherFirewall is the clear choice for = this.

Good luck!

-Scott


> -----Original Message-----
> From: John Angelmo [mailto:john@veidit.net]
> Sent: Monday, May 20, 2002 1:40 PM
> To: net@freebsd.org
> Subject: "dynamic" ipfw
>
>
> Hello
>
> I have a small problem with IPFW
>
> How can I handle adding and removing rules = based on IP/MAC per user?
> I can add a rule for a specific IP/MAC without = the need to
> flush but can
> I remove it in the same way?
>
> now lets say I have a user that only needs = access to it's mailserver
> mail.user.com with pop3 and smtp
> then the rule for pop3 would be something = like
> add allow ip from mail.user.com 110 to IP/HOST = (MAC dosn't
> work here right?)
>
> Now mail.user.com uses runrobin so the IP = changes from request to
> request but dosn't the IPFW resolve the IP when = its added to
> the rules,
> how can this be solved for the user?
>
> /John
>
>
> To Unsubscribe: send mail to = majordomo@FreeBSD.org
> with "unsubscribe freebsd-net" in the = body of the message
>

------_=_NextPart_001_01C2004C.F2595350-- To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-net" in the body of the message