From owner-freebsd-questions@FreeBSD.ORG Mon Nov 29 15:13:13 2004 Return-Path: Delivered-To: freebsd-questions@freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id B447916A4CE for ; Mon, 29 Nov 2004 15:13:13 +0000 (GMT) Received: from ei.bzerk.org (ei.xs4all.nl [213.84.67.5]) by mx1.FreeBSD.org (Postfix) with ESMTP id 0D87F43D1D for ; Mon, 29 Nov 2004 15:13:13 +0000 (GMT) (envelope-from mail25@bzerk.org) Received: from ei.bzerk.org (BOFH@localhost [127.0.0.1]) by ei.bzerk.org (8.13.1/8.13.1) with ESMTP id iATFE7qn074841; Mon, 29 Nov 2004 16:14:07 +0100 (CET) (envelope-from mail25@bzerk.org) Received: (from bulk@localhost) by ei.bzerk.org (8.13.1/8.13.1/Submit) id iATFE7Xx074840; Mon, 29 Nov 2004 16:14:07 +0100 (CET) (envelope-from mail25@bzerk.org) Date: Mon, 29 Nov 2004 16:14:07 +0100 From: Ruben de Groot To: Jonathon McKitrick Message-ID: <20041129151407.GA74785@ei.bzerk.org> Mail-Followup-To: Ruben de Groot , Jonathon McKitrick , freebsd-questions@freebsd.org References: <20041127215612.GA86416@dogma.freebsd-uk.eu.org> <20041128013135.GD662@gothmog.gr> <20041128044847.GA1435@dogma.freebsd-uk.eu.org> <20041128122741.GB43088@gothmog.gr> <20041129113020.GA72673@ei.bzerk.org> <20041129132114.GA66047@dogma.freebsd-uk.eu.org> <20041129140930.GA73929@ei.bzerk.org> <20041129144458.GA69798@dogma.freebsd-uk.eu.org> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <20041129144458.GA69798@dogma.freebsd-uk.eu.org> User-Agent: Mutt/1.4.2.1i X-Spam-Status: No, score=-2.3 required=5.0 tests=ALL_TRUSTED, FROM_ENDS_IN_NUMS autolearn=failed version=3.0.0 X-Spam-Checker-Version: SpamAssassin 3.0.0 (2004-09-13) on ei.bzerk.org cc: freebsd-questions@freebsd.org Subject: Re: Is this a hole in my firewall? X-BeenThere: freebsd-questions@freebsd.org X-Mailman-Version: 2.1.1 Precedence: list List-Id: User questions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 29 Nov 2004 15:13:13 -0000 On Mon, Nov 29, 2004 at 02:44:58PM +0000, Jonathon McKitrick typed: > On Mon, Nov 29, 2004 at 03:09:30PM +0100, Ruben de Groot wrote: > : On Mon, Nov 29, 2004 at 01:21:14PM +0000, Jonathon McKitrick typed: > : > On Mon, Nov 29, 2004 at 12:30:20PM +0100, Ruben de Groot wrote: > : > : He's using ppp-nat. So packets from his laptop will first hit rule #300 and > : > : only after that get "nat'ed". I believe this is normal behaviour. > : > > : > Ah, yes. I always forget about ppp-nat. > : > > : > So, then, is this the best way to allow my laptop packets out? Or does it > : > still leave the laptop exposed? I'd like to protect all the machines with > : > one firewall, while keeping it simple, if possible. > : > : Your laptop won't be "exposed" by this. You could however finetune your > : ruleset a little bit by modifying rule 300 to something like: > : > : allow ip from ${INTERNAL_NET} to any keep-state out xmit tun0 > : > : where INTERNAL_NET would be e.g. 192.168.0.0/24 > > Should I also run a firewall on the laptop then, since all traffic to the > laptop is allowed to pass? No. Only traffic on connections that were initiated by your laptop is allowed to pass. That what a stateful firewall does. Ruben > > jm > --