From owner-freebsd-questions Mon Dec 16 17: 2:21 2002 Delivered-To: freebsd-questions@freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id D62B537B401 for ; Mon, 16 Dec 2002 17:02:19 -0800 (PST) Received: from sage.thought.org (dsl231-043-140.sea1.dsl.speakeasy.net [216.231.43.140]) by mx1.FreeBSD.org (Postfix) with ESMTP id 5F30D43EC5 for ; Mon, 16 Dec 2002 17:02:15 -0800 (PST) (envelope-from kline@thought.org) Received: from thought.org (root@tao [10.0.0.247]) by sage.thought.org (8.11.4/8.11.4) with ESMTP id gBH12O827535 for ; Mon, 16 Dec 2002 17:02:25 -0800 (PST) (envelope-from kline@thought.org) Received: (from kline@localhost) by thought.org (8.12.6/8.11.3) id gBH12ETt023377 for freebsd-questions@FreeBSD.ORG; Mon, 16 Dec 2002 17:02:14 -0800 (PST) (envelope-from kline) Date: Mon, 16 Dec 2002 17:02:14 -0800 From: Gary D Kline To: FreeBSD Mailing List Subject: Are these IPF -> IPFW protocols equivalent? Message-ID: <20021217010213.GA23339@tao.thought.org> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline X-Organization: Thought Unlimited. Public service Unix since 1986. X-Of_Interest: Observing 16 years of service to the Unix community User-Agent: Mutt/1.5.1i Sender: owner-freebsd-questions@FreeBSD.ORG Precedence: bulk List-ID: List-Archive: (Web Archive) List-Help: (List Instructions) List-Subscribe: List-Unsubscribe: X-Loop: FreeBSD.ORG Just a couple more questions on the migation to ipfw and this much should be done. Do I need to write for the "out" rule in ipfw, "out xmit via dc0"? Similarly for the "in" rule, do I need the "recv"? I thought I'd better check with the list for input on this. How close did I come with these 6 lines? thanks very much!! gary # Inside Interface (ipf) {IPF] pass out quick on dc1 proto tcp from any to any keep state {IPF] pass out quick on dc1 proto icmp from any to any keep state {IPF] block out quick on dc1 all {IPF] pass in quick on dc1 proto tcp from any to any keep state {IPF] pass in quick on dc1 proto icmp from any to any keep state {IPF] block in quick on dc1 all # Loopback Interface {IPF] pass in quick on lo0 all {IPF] pass out quick on lo0 all # Inside Interface (ipfw) [IPFW] add 200 allow tcp from any to any out xmit via dc0 keep-state [IPFW] add 200 allow icmp from any to any out xmit via dc0 keep-state [IPFW] add deny ip from any to any out xmit via dc0 [IPFW] add 200 allow tcp from any to any in recv via dc0 keep-state [IPFW] add 200 allow icmp from any to any in recv via dc0 keep-state [IPFW] add deny ip from any to any in recv via dc0 # Loopback Interface [IPFW] add allow ip from 127.0.0.1 to 127.0.0.1 in recv via lo0 [IPFW] add allow ip from 127.0.0.1 to 127.0.0.1 out xmit via lo0 -- Gary Kline kline@thought.org www.thought.org Public service Unix To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-questions" in the body of the message