Skip site navigation (1)Skip section navigation (2)
Date:      Wed, 20 Dec 2000 09:57:18 -0800 (PST)
From:      Luigi Rizzo <rizzo@aciri.org>
To:        freebsd@canyon.demon.nl (Rene de Vries)
Cc:        freebsd-hackers@FreeBSD.ORG
Subject:   Re: statefull packet filter together with natd question
Message-ID:  <200012201757.eBKHvIb77566@iguana.aciri.org>
In-Reply-To: <20001220184937.A788@canyon.demon.nl> from Rene de Vries at "Dec 20, 2000  6:49:37 pm"

next in thread | previous in thread | raw e-mail | index | archive | help
> Hello,
> 
> Some time a go I posted the same question to freebsd-questions, but uptill now
> I didn't get an answer.
> 
> Currently I'm trying to move towards a statefull packet filter. When testing
> without nat all seems to work fine. But when I added natd (as the first
> rule) packets that were natd-ed on their way out had their return traffic
> blocked. The question is, what am I doing wrong?!?

nat changes addresses and then reinjects packets in the firewall.
Chances are that there is no dynamic rule matching the
packet after the translation.

	cheers
	luigi

> I hope somebody can tell me how to solve this problem.
> 
> Rene
> 
> from my logs:
> 
> ipfw: Accept TCP 212.238.x.x:1026 x.x.x.x:23 out via isp0
> ipfw: Deny TCP x.x.x.x:23 192.168.1.3:1026 in via isp0
> 
> ipfw rules:
> 
> /sbin/ipfw -f flush
> 
> /sbin/ipfw -q add divert natd all from any to any via isp0
> 
> /sbin/ipfw -q add allow all from any to any via lo0
> /sbin/ipfw -q add allow all from any to any via dc0
> 
> /sbin/ipfw -q add check-state from any to any via isp0
> /sbin/ipfw -q add deny log tcp from any to any established
> /sbin/ipfw -q add allow all from any to any out via isp0 keep-state
> 
> /sbin/ipfw -q add deny log all from any to any
> 
> -- 
> Rene de Vries                        http://www.tcja.nl mailto:rene@tcja.nl
> 
> 
> To Unsubscribe: send mail to majordomo@FreeBSD.org
> with "unsubscribe freebsd-hackers" in the body of the message
> 



To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-hackers" in the body of the message




Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?200012201757.eBKHvIb77566>