From owner-freebsd-questions Mon Oct 1 3:50:40 2001 Delivered-To: freebsd-questions@freebsd.org Received: from mail.itvsystems.com.ua (mail.itvsystems.com.ua [212.9.225.142]) by hub.freebsd.org (Postfix) with ESMTP id 5365037B409 for ; Mon, 1 Oct 2001 03:50:33 -0700 (PDT) Received: from lex (lex.itv [192.168.1.84]) by mail.itvsystems.com.ua (Postfix) with ESMTP id 426E29B2E for ; Mon, 1 Oct 2001 13:52:19 +0300 (EEST) Date: Mon, 1 Oct 2001 13:50:51 +0300 From: "Alexander S. Usov" X-Mailer: The Bat! (v1.47 Halloween Edition) Personal Reply-To: "Alexander S. Usov" Organization: ITV X-Priority: 3 (Normal) Message-ID: <1251438768.20011001135051@itv.kiev.ua> To: questions@FreeBSD.ORG Subject: Need a help with ipfw configuration Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: 7bit Sender: owner-freebsd-questions@FreeBSD.ORG Precedence: bulk List-ID: List-Archive: (Web Archive) List-Help: (List Instructions) List-Subscribe: List-Unsubscribe: X-Loop: FreeBSD.ORG Hello everybody, I have a little question about ipfw. Can anybody explan me the flow of the packets for the following configuration: 192.168.1.1 192.168.0.2 {local network}--{rl0 |FreeBSD host| rl1}--{IDSL router} The thing I have to do is traffic accounting (with IPA). IPFW config looks like that: $fw -f flush # local loopback $fw add 10 allow all from any to any via lo0 # general limitaions $fw add 40 deny all from 192.168.0.0/16 to any in via rl1 $fw add 40 deny all from any to 192.168.0.0/16 out via rl1 $fw add 40 deny all from 172.16.0.0/12 to any in via rl1 $fw add 40 deny all from any to 172.16.0.0/12 out via rl1 $fw add 40 deny all from 10.0.0.0/8 to any in via rl1 $fw add 40 deny all from any to 10.0.0.0/8 out via rl1 $fw add 50 deny all from not 192.168.1.0/24 to any in via rl0 $fw add 50 deny all from any to not 192.168.1.0/24 out via rl0 # there is a counters for i in `/usr/bin/jot 254` do $fw add $((11000+$i)) count all from 192.168.1.$i to not 192.168.1.0/24 in via rl0 $fw add $((11000+$i)) count all from not 192.168.1.0/24 to 192.168.1.$i out via rl0 done # NAT $fw add 12000 divert natd all from any to any via rl1 ............. As I understand, couners would work on the second pass, but I should be sure. PS. Please, send a copy of the rely to me, I am not subscribed to the list. PPS. Sorry for my bad english. -- Best regards, Alexander mailto:lex@itv.kiev.ua To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-questions" in the body of the message