From owner-freebsd-questions Sat Jan 12 11:47:22 2002 Delivered-To: freebsd-questions@freebsd.org Received: from viefep16-int.chello.at (viefep16-int.chello.at [213.46.255.17]) by hub.freebsd.org (Postfix) with ESMTP id 948BA37B405 for ; Sat, 12 Jan 2002 11:47:06 -0800 (PST) Received: from unet.univie.ac.at ([62.178.142.175]) by viefep16-int.chello.at (InterMail vM.5.01.03.06 201-253-122-118-106-20010523) with ESMTP id <20020112194705.BFOC1238.viefep16-int.chello.at@unet.univie.ac.at> for ; Sat, 12 Jan 2002 20:47:05 +0100 Message-ID: <3C190917.AD60F415@unet.univie.ac.at> Date: Thu, 13 Dec 2001 21:01:27 +0100 From: Peter Wolkerstorfer X-Mailer: Mozilla 4.73 [de]C-CCK-MCD QXW03240 (Win98; U) X-Accept-Language: de,en MIME-Version: 1.0 To: freebsd-questions@freebsd.org Subject: Re: please help on 1(one) ipf rule - still not working References: <3C187D20.E1901AD5@unet.univie.ac.at> <20020112132633.E31058@b1n.org> Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: 7bit Sender: owner-freebsd-questions@FreeBSD.ORG Precedence: bulk List-ID: List-Archive: (Web Archive) List-Help: (List Instructions) List-Subscribe: List-Unsubscribe: X-Loop: FreeBSD.ORG dear listmembers, THX to BinarySoul and Mark Woodson for their hints. with their info i adopted the ipf.rules (ipf v.3.4.20 on fbsd 4.4.) like this: pass out quick on rl1 proto tcp from 192.168.0.0/16 to any flags S/SA keep state pass out quick on rl1 proto udp from 192.168.0.0/16 to any keep state pass out quick on rl1 proto icmp from 192.168.0.0/16 to any keep state block in on rl1 all rl1 is the interface to external network, rl0 is internal network. what i want to do: block ALL incoming traffic from the internet (also ssh) but connect to the firewall from the internal network. problem: i can't ssh-login from INTERNAL network to the firewall (which is probably that i cannot ssh-login from 192.168.0.11 to 192.168.0.1; 192.168.0.1 is the firewall and the corresponding interface is rl0) BUT: i can do everything i want (including SSH) OVER the firewall i tried pass in quick on rl0 all before the block to let me in with ssh on the rl0 interface but it also didn't work; any ideas? THX in advance peter "wolki" wolkerstorfer To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-questions" in the body of the message