From owner-freebsd-ipfw  Mon Oct  9  0:44:31 2000
Delivered-To: freebsd-ipfw@freebsd.org
Received: from web1405.mail.yahoo.com (web1405.mail.yahoo.com [128.11.23.169])
	by hub.freebsd.org (Postfix) with SMTP id 49E2937B502
	for <freebsd-ipfw@FreeBSD.ORG>; Mon,  9 Oct 2000 00:44:28 -0700 (PDT)
Received: (qmail 19210 invoked by uid 60001); 9 Oct 2000 07:44:27 -0000
Message-ID: <20001009074427.19209.qmail@web1405.mail.yahoo.com>
Received: from [159.148.130.2] by web1405.mail.yahoo.com; Mon, 09 Oct 2000 00:44:27 PDT
Date: Mon, 9 Oct 2000 00:44:27 -0700 (PDT)
From: John Braun <uktests@yahoo.com>
Subject: Need for allow FTP via fw
To: freebsd-ipfw@FreeBSD.ORG
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Sender: owner-freebsd-ipfw@FreeBSD.ORG
Precedence: bulk
X-Loop: FreeBSD.ORG

I need to allow connect from my local 
network (192.168.168.0/255.255.255.240) 
to external host (IP=123.123.123.123)

I have changed rc.firewall rules. 
But with these changes it works very slowly. 

May be my changes it no so correct??
Where is a problem? 

///////////////////////////////////////////////////////
# Stop spoofing
${fwcmd} add deny all from ${inet}:${imask} to any in
via ${oif}
${fwcmd} add deny all from ${onet}:${omask} to any in
via ${iif}


# Stop RFC1918 nets on the outside interface
${fwcmd} add pass tcp from 123.123.123.123 to any 
${fwcmd} add pass tcp from any to 123.123.123.123
${fwcmd} add deny all from 10.0.0.0/8 to any via
${oif}
${fwcmd} add deny all from any to 10.0.0.0/8 via
${oif}
${fwcmd} add deny all from 172.16.0.0/12 to any via
${oif}
${fwcmd} add deny all from any to 172.16.0.0/12 via
${oif} 
${fwcmd} add deny all from 192.168.0.0/16 to any via
${oif}
${fwcmd} add deny all from any to 192.168.0.0/16 via
${oif}

# Stop draft-manning-dsua-01.txt nets on the outside
interface
${fwcmd} add deny all from 0.0.0.0/8 to any via ${oif}
${fwcmd} add deny all from any to 0.0.0.0/8 via ${oif}
${fwcmd} add deny all from 169.254.0.0/16 to any via
${oif}
${fwcmd} add deny all from any to 169.254.0.0/16 via
${oif}
${fwcmd} add deny all from 192.0.2.0/24 to any via
${oif}
${fwcmd} add deny all from any to 192.0.2.0/24 via
${oif}
${fwcmd} add deny all from 224.0.0.0/4 to any via
${oif}
${fwcmd} add deny all from any to 224.0.0.0/4 via
${oif}
${fwcmd} add deny all from 240.0.0.0/4 to any via
${oif}
${fwcmd} add deny all from any to 240.0.0.0/4 via
${oif}

#Allow anything to internal network
${fwcmd} add pass all from ${inet}:${imask} to
${inet}:${imask} via ${iif}

# Allow TCP through if setup succeeded
${fwcmd} add pass tcp from any to any established
        
#Allow ICMP
${fwcmd} add pass icmp from any to any  icmptypes
8,0,11,3

# Allow IP fragments to pass through
${fwcmd} add pass all from any to any frag

# Allow setup of incoming email
${fwcmd} add pass tcp from any to ${oip} 25 setup

# For FTP
${fwcmd} add pass tcp from any to ${oip} 21 setup


# Reject&Log all setup of incoming connections from
the outside
${fwcmd} add deny log tcp from any to any in via
${oif} setup

# Allow setup of any other TCP connection
${fwcmd} add pass tcp from any to any setup

# Allow DNS queries out in the world
${fwcmd} add pass udp from any 53 to ${oip}
${fwcmd} add pass udp from ${oip} to any 53

# Allow NTP queries out in the world
${fwcmd} add pass udp from any 123 to ${oip}
${fwcmd} add pass udp from ${oip} to any 123
//////////////////////////////////////////////////////

__________________________________________________
Do You Yahoo!?
Yahoo! Photos - 35mm Quality Prints, Now Get 15 Free!
http://photos.yahoo.com/


To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-ipfw" in the body of the message