Date: Mon, 9 Oct 2000 00:44:27 -0700 (PDT) From: John Braun <uktests@yahoo.com> To: freebsd-ipfw@FreeBSD.ORG Subject: Need for allow FTP via fw Message-ID: <20001009074427.19209.qmail@web1405.mail.yahoo.com>
next in thread | raw e-mail | index | archive | help
I need to allow connect from my local
network (192.168.168.0/255.255.255.240)
to external host (IP=123.123.123.123)
I have changed rc.firewall rules.
But with these changes it works very slowly.
May be my changes it no so correct??
Where is a problem?
///////////////////////////////////////////////////////
# Stop spoofing
${fwcmd} add deny all from ${inet}:${imask} to any in
via ${oif}
${fwcmd} add deny all from ${onet}:${omask} to any in
via ${iif}
# Stop RFC1918 nets on the outside interface
${fwcmd} add pass tcp from 123.123.123.123 to any
${fwcmd} add pass tcp from any to 123.123.123.123
${fwcmd} add deny all from 10.0.0.0/8 to any via
${oif}
${fwcmd} add deny all from any to 10.0.0.0/8 via
${oif}
${fwcmd} add deny all from 172.16.0.0/12 to any via
${oif}
${fwcmd} add deny all from any to 172.16.0.0/12 via
${oif}
${fwcmd} add deny all from 192.168.0.0/16 to any via
${oif}
${fwcmd} add deny all from any to 192.168.0.0/16 via
${oif}
# Stop draft-manning-dsua-01.txt nets on the outside
interface
${fwcmd} add deny all from 0.0.0.0/8 to any via ${oif}
${fwcmd} add deny all from any to 0.0.0.0/8 via ${oif}
${fwcmd} add deny all from 169.254.0.0/16 to any via
${oif}
${fwcmd} add deny all from any to 169.254.0.0/16 via
${oif}
${fwcmd} add deny all from 192.0.2.0/24 to any via
${oif}
${fwcmd} add deny all from any to 192.0.2.0/24 via
${oif}
${fwcmd} add deny all from 224.0.0.0/4 to any via
${oif}
${fwcmd} add deny all from any to 224.0.0.0/4 via
${oif}
${fwcmd} add deny all from 240.0.0.0/4 to any via
${oif}
${fwcmd} add deny all from any to 240.0.0.0/4 via
${oif}
#Allow anything to internal network
${fwcmd} add pass all from ${inet}:${imask} to
${inet}:${imask} via ${iif}
# Allow TCP through if setup succeeded
${fwcmd} add pass tcp from any to any established
#Allow ICMP
${fwcmd} add pass icmp from any to any icmptypes
8,0,11,3
# Allow IP fragments to pass through
${fwcmd} add pass all from any to any frag
# Allow setup of incoming email
${fwcmd} add pass tcp from any to ${oip} 25 setup
# For FTP
${fwcmd} add pass tcp from any to ${oip} 21 setup
# Reject&Log all setup of incoming connections from
the outside
${fwcmd} add deny log tcp from any to any in via
${oif} setup
# Allow setup of any other TCP connection
${fwcmd} add pass tcp from any to any setup
# Allow DNS queries out in the world
${fwcmd} add pass udp from any 53 to ${oip}
${fwcmd} add pass udp from ${oip} to any 53
# Allow NTP queries out in the world
${fwcmd} add pass udp from any 123 to ${oip}
${fwcmd} add pass udp from ${oip} to any 123
//////////////////////////////////////////////////////
__________________________________________________
Do You Yahoo!?
Yahoo! Photos - 35mm Quality Prints, Now Get 15 Free!
http://photos.yahoo.com/
To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-ipfw" in the body of the message
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20001009074427.19209.qmail>