From owner-freebsd-ipfw Thu Aug 10 15:45:21 2000 Delivered-To: freebsd-ipfw@freebsd.org Received: from stratus.cloudfactory.org (cloudfactory.org [205.179.129.18]) by hub.freebsd.org (Postfix) with ESMTP id 5D46637B5F7 for ; Thu, 10 Aug 2000 15:45:18 -0700 (PDT) (envelope-from terrac@cloudfactory.org) Received: from localhost (terrac@localhost) by stratus.cloudfactory.org (8.8.8/8.8.7) with ESMTP id PAA27283; Thu, 10 Aug 2000 15:47:30 -0700 Date: Thu, 10 Aug 2000 15:47:30 -0700 (PDT) From: TeRrAc To: Nick Rogness Cc: FreeBSD IPFW list Subject: Re: natd + IPFW (I think i have the solution) In-Reply-To: Message-ID: MIME-Version: 1.0 Content-Type: TEXT/PLAIN; charset=US-ASCII Sender: owner-freebsd-ipfw@FreeBSD.ORG Precedence: bulk X-Loop: FreeBSD.ORG Hi there, In re-reading this mail from Nick I see what my problem might be. My outside interface is fxp0, and the inside is fxp1. The packet flow goes like this [DSL Gateway] <---> [fxp0 <--> fxp1] <----> {the internal network} I had the IPFW diverting all packets through fxp1, and it appears that I need to have them diverted through fxp0 instead. I will not know of course until I get home and can try it out. In the meantime of course, can anyone cofirm or deny this? t e r r a c " and they call *ME* strange " On Wed, 9 Aug 2000, Nick Rogness wrote: > On Wed, 9 Aug 2000, TeRrAc wrote: > > > Natd is in fadct running, > > With what options? It should be: /sbin/natd -n fxp1 > > > > > > > I know that is a bass-ackwards rulset, usually I have been testing it > > like: > > 00100 1849 185456 divert 8668 ip from any to any via fxp1 > > 00500 32 2404 allow ip from any to any > > 00600 0 0 allow ip from any to any > > 65535 83 5902 deny ip from any to any > > > This looks OK...if fxp1 is indeed your outside interface. > > > > > It seems logical enough that all packets should first be diverted > > through natd (the 8668) through the interface, then passed without regard > > through the rest of the system. > > They are sent through Natd, then re-injected back into the > firewall at the next rule number. > > > > Do i need another divert statement on fxp0 to bring them back? > > No. The above ruleset should work. How are you testing to see if > it works. Can you get out from your BSD machine without using > nat? > > Nick Rogness > - Drive defensively. Buy a tank. > > > > > To Unsubscribe: send mail to majordomo@FreeBSD.org > with "unsubscribe freebsd-ipfw" in the body of the message > To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-ipfw" in the body of the message