From owner-freebsd-questions@FreeBSD.ORG  Mon May 19 08:42:08 2003
Return-Path: <owner-freebsd-questions@FreeBSD.ORG>
Delivered-To: freebsd-questions@freebsd.org
Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125])
	by hub.freebsd.org (Postfix) with ESMTP id 850A737B401
	for <freebsd-questions@freebsd.org>;
	Mon, 19 May 2003 08:42:08 -0700 (PDT)
Received: from mx0.sunn.net (shub-niggurath.unknownkadath.net
	[209.153.153.182])
	by mx1.FreeBSD.org (Postfix) with ESMTP id 437E643FA3
	for <freebsd-questions@freebsd.org>;
	Mon, 19 May 2003 08:42:05 -0700 (PDT)
	(envelope-from asenchi@asenchi.com)
Received: from wj (ppc.tcimet.net [198.109.164.203])
	by mx0.sunn.net (8.12.9/8.12.7) with SMTP id h4JFg3N2017254
	for <freebsd-questions@freebsd.org>;
	Mon, 19 May 2003 11:42:04 -0400 (EDT)
Message-ID: <012701c31e1d$05d90760$8200a8c0@wj>
From: "Asenchi" <asenchi@asenchi.com>
To: <freebsd-questions@freebsd.org>
Date: Mon, 19 May 2003 11:40:43 -0400
MIME-Version: 1.0
Content-Type: text/plain;
	charset="iso-8859-1"
Content-Transfer-Encoding: 7bit
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2800.1106
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1106
Subject: ipfw2 & natd & stateful
X-BeenThere: freebsd-questions@freebsd.org
X-Mailman-Version: 2.1.1
Precedence: list
List-Id: User questions <freebsd-questions.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-questions>,
	<mailto:freebsd-questions-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-questions>
List-Post: <mailto:freebsd-questions@freebsd.org>
List-Help: <mailto:freebsd-questions-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-questions>,
	<mailto:freebsd-questions-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Mon, 19 May 2003 15:42:08 -0000

Hello Everyone.

I have a bit of a problem. I want to switch my company's firewall to IPFW2
but I can't seem to get the ruleset to work. After sidelining the notion, I
am ready to attack this again. I have had many problems with it. (You can
see a discussion on this issue here:
<http://www.freebsdforums.org/forums/showthread.php?s=&threadid=9061)

It seems that NATD is stopping anyone on my internal network from getting
through to websites. I does some how reach DNS but won't go anywhere else. I
have tried multiple things...

I use this ruleset almost verbatim on another machine that isn't running
NATD. Can anyone see anything here? I don't subscribe to this list with this
email address, so could you please cc me?

Thanks in advance to anyone who can offer some light...

////curt////

Here is the output of 'ipfw -d show'

00100 0 0 check-state
00200 4 164 deny log logamount 1000 ip from any to any established
00300 28 1789 divert 8668 ip from any to any via vr0
00400 0 0 deny log logamount 10 ip from 192.168.0.0/24 to any via vr0
00500 38 3897 allow { tcp or udp } from me to { 198.109.160.2 or dst-ip
198.109.160.3 or dst-ip d.n.s.1 or dst-ip d.n.s.2 } dst-port 53 out xmit vr0
keep-state
00600 306 31838 allow tcp from { o.u.t.2/29 or o.u.t.1 or 2.1.0.0/16 or
1.1.0.0/16 } to me dst-port 22 setup in recv vr0 keep-state
00700 22 992 allow tcp from me to any setup via vr0 keep-state
00800 2 120 deny log logamount 1000 { tcp or udp } from any to me
01000 7 336 allow log logamount 1000 tcp from i.n.t.r/24 to any dst-port 80
01100 0 0 allow tcp from 192.168.0.0/24 to any setup keep-state
01200 66 4168 allow { tcp or udp } from 192.168.0.0/24 to { d.n.s.3 or
dst-ip d.n.s.4 or dst-ip d.n.s.1 or dst-ip d.n.s.2 } dst-port 53 keep-state
01300 0 0 allow tcp from any to 192.168.0.0/24{3,10,11,12,21,110} dst-port
6501-6504 setup in recv vr0 keep-state
01500 0 0 deny icmp from any to me icmptypes 8
01600 131 5560 allow icmp from any to any
01800 3 234 deny { tcp or udp } from any to any dst-port 137,138,520
01900 4 304 deny log logamount 1000 ip from any to any
65535 0 0 deny ip from any to any

## Dynamic rules (28):
01200 3 192 (9s) STATE udp 192.168.0.64 1072 <-> d.n.s.3 53
01200 5 320 (9s) STATE udp 192.168.0.64 1072 <-> d.n.s.2 53
00600 305 31778 (300s) STATE tcp m.y.i.p 3020 <-> o.u.t.1 22