From owner-freebsd-questions@FreeBSD.ORG  Mon Nov 29 14:08:38 2004
Return-Path: <owner-freebsd-questions@FreeBSD.ORG>
Delivered-To: freebsd-questions@freebsd.org
Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125])
	by hub.freebsd.org (Postfix) with ESMTP id 30BD916A4CE
	for <freebsd-questions@freebsd.org>;
	Mon, 29 Nov 2004 14:08:38 +0000 (GMT)
Received: from ei.bzerk.org (ei.xs4all.nl [213.84.67.5])
	by mx1.FreeBSD.org (Postfix) with ESMTP id 80DAD43D3F
	for <freebsd-questions@freebsd.org>;
	Mon, 29 Nov 2004 14:08:37 +0000 (GMT)
	(envelope-from mail25@bzerk.org)
Received: from ei.bzerk.org (BOFH@localhost [127.0.0.1])
	by ei.bzerk.org (8.13.1/8.13.1) with ESMTP id iATE9Ue0074228;
	Mon, 29 Nov 2004 15:09:30 +0100 (CET)
	(envelope-from mail25@bzerk.org)
Received: (from bulk@localhost)
	by ei.bzerk.org (8.13.1/8.13.1/Submit) id iATE9Uxa074227;
	Mon, 29 Nov 2004 15:09:30 +0100 (CET)
	(envelope-from mail25@bzerk.org)
Date: Mon, 29 Nov 2004 15:09:30 +0100
From: Ruben de Groot <mail25@bzerk.org>
To: Jonathon McKitrick <jcm@FreeBSD-uk.eu.org>
Message-ID: <20041129140930.GA73929@ei.bzerk.org>
Mail-Followup-To: Ruben de Groot <mail25@bzerk.org>,
	Jonathon McKitrick <jcm@FreeBSD-uk.eu.org>,
	Giorgos Keramidas <keramida@ceid.upatras.gr>,
	freebsd-questions@freebsd.org
References: <20041127215612.GA86416@dogma.freebsd-uk.eu.org>
	<20041128013135.GD662@gothmog.gr>
	<20041128044847.GA1435@dogma.freebsd-uk.eu.org>
	<20041128122741.GB43088@gothmog.gr> <20041129113020.GA72673@ei.bzerk.org>
	<20041129132114.GA66047@dogma.freebsd-uk.eu.org>
Mime-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <20041129132114.GA66047@dogma.freebsd-uk.eu.org>
User-Agent: Mutt/1.4.2.1i
X-Spam-Status: No, score=-2.3 required=5.0 tests=ALL_TRUSTED,
	FROM_ENDS_IN_NUMS autolearn=failed version=3.0.0
X-Spam-Checker-Version: SpamAssassin 3.0.0 (2004-09-13) on ei.bzerk.org
cc: Giorgos Keramidas <keramida@ceid.upatras.gr>
cc: Ruben de Groot <mail25@bzerk.org>
cc: freebsd-questions@freebsd.org
Subject: Re: Is this a hole in my firewall?
X-BeenThere: freebsd-questions@freebsd.org
X-Mailman-Version: 2.1.1
Precedence: list
List-Id: User questions <freebsd-questions.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-questions>,
	<mailto:freebsd-questions-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-questions>
List-Post: <mailto:freebsd-questions@freebsd.org>
List-Help: <mailto:freebsd-questions-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-questions>,
	<mailto:freebsd-questions-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Mon, 29 Nov 2004 14:08:38 -0000

On Mon, Nov 29, 2004 at 01:21:14PM +0000, Jonathon McKitrick typed:
> On Mon, Nov 29, 2004 at 12:30:20PM +0100, Ruben de Groot wrote:
> : He's using ppp-nat. So packets from his laptop will first hit rule #300 and
> : only after that get "nat'ed". I believe this is normal behaviour.
> 
> Ah, yes.  I always forget about ppp-nat.
> 
> So, then, is this the best way to allow my laptop packets out?  Or does it
> still leave the laptop exposed?  I'd like to protect all the machines with
> one firewall, while keeping it simple, if possible.

Your laptop won't be "exposed" by this. You could however finetune your
ruleset a little bit by modifying rule 300 to something like:

allow ip from ${INTERNAL_NET} to any keep-state out xmit tun0

where INTERNAL_NET would be e.g. 192.168.0.0/24

Ruben