Date: Mon, 2 Oct 2000 17:18:20 -0700 From: Brent Kearney <brent@kearneys.ca> To: Steve Jorgensen <steve@khoral.com> Cc: FreeBSD Questions <freebsd-questions@FreeBSD.org> Subject: Re: ipfw & natd config problems Message-ID: <20001002171820.B6866@kearneys.ca> In-Reply-To: <200010021919.NAA09032@khoral.com>; from steve@khoral.com on Mon, Oct 02, 2000 at 01:19:01PM -0600 References: <200010021919.NAA09032@khoral.com>
next in thread | previous in thread | raw e-mail | index | archive | help
On Mon, Oct 02, 2000 at 01:19:01PM -0600, Steve Jorgensen wrote:
>
> I'm trying to set up a FreeBSD-4.1.1 box as a
> firewall for my network. We're using ipfw and natd.
> I've got things pretty much working, but I'm having
> two problems..
>
> #1: I get lots of messages like:
>
> natd[163]: failed to write packet back (Permission denied)
>
> I can't figure out why this is happening.
>
> #2: Externally, I can get to our webserver using the
> public address (www.khoral.com). However, internally,
> I get connection denied whenever I use www.khoral.com,
> but the internal hostname works fine. Natd is redirecting
> port 80 on the external interface to the internal web
> server. Is there anyway to configure this so that the
> external names for ftp and www work for internal machines?
>
> Thanks for any help.
It sounds like ipfw is blocking access from 192.168. (or some other
internal net) addresses on one interface. Look in your rc.firewall
for a rule like:
$fwcmd add deny all from 192.168.0.0:255.255.0.0 to any via ${oif}
$fwcmd add deny log all from any to 192.168.0.0:255.255.0.0 via ${oif}
Aside from playing around with this type of fw rule, try starting natd
in debug mode to get a closer look at what is going on.
Good luck!
-Brent
---------------------------------------------------------------
Brent Kearney
brent@kearneys.ca
"...thus the metric system did not really catch on in the States,
unless you count the increasing popularity of the nine-millimeter
bullet."
--Dave Barry
To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-questions" in the body of the message
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20001002171820.B6866>