From owner-freebsd-hackers Wed Dec 20 9:57:29 2000 From owner-freebsd-hackers@FreeBSD.ORG Wed Dec 20 09:57:26 2000 Return-Path: Delivered-To: freebsd-hackers@freebsd.org Received: from iguana.aciri.org (iguana.aciri.org [192.150.187.36]) by hub.freebsd.org (Postfix) with ESMTP id E592D37B400 for ; Wed, 20 Dec 2000 09:57:25 -0800 (PST) Received: (from rizzo@localhost) by iguana.aciri.org (8.11.1/8.11.1) id eBKHvIb77566; Wed, 20 Dec 2000 09:57:18 -0800 (PST) (envelope-from rizzo) From: Luigi Rizzo Message-Id: <200012201757.eBKHvIb77566@iguana.aciri.org> Subject: Re: statefull packet filter together with natd question In-Reply-To: <20001220184937.A788@canyon.demon.nl> from Rene de Vries at "Dec 20, 2000 6:49:37 pm" To: freebsd@canyon.demon.nl (Rene de Vries) Date: Wed, 20 Dec 2000 09:57:18 -0800 (PST) Cc: freebsd-hackers@FreeBSD.ORG X-Mailer: ELM [version 2.4ME+ PL43 (25)] MIME-Version: 1.0 Content-Type: text/plain; charset=US-ASCII Content-Transfer-Encoding: 7bit Sender: rizzo@iguana.aciri.org Sender: owner-freebsd-hackers@FreeBSD.ORG Precedence: bulk X-Loop: FreeBSD.ORG > Hello, > > Some time a go I posted the same question to freebsd-questions, but uptill now > I didn't get an answer. > > Currently I'm trying to move towards a statefull packet filter. When testing > without nat all seems to work fine. But when I added natd (as the first > rule) packets that were natd-ed on their way out had their return traffic > blocked. The question is, what am I doing wrong?!? nat changes addresses and then reinjects packets in the firewall. Chances are that there is no dynamic rule matching the packet after the translation. cheers luigi > I hope somebody can tell me how to solve this problem. > > Rene > > from my logs: > > ipfw: Accept TCP 212.238.x.x:1026 x.x.x.x:23 out via isp0 > ipfw: Deny TCP x.x.x.x:23 192.168.1.3:1026 in via isp0 > > ipfw rules: > > /sbin/ipfw -f flush > > /sbin/ipfw -q add divert natd all from any to any via isp0 > > /sbin/ipfw -q add allow all from any to any via lo0 > /sbin/ipfw -q add allow all from any to any via dc0 > > /sbin/ipfw -q add check-state from any to any via isp0 > /sbin/ipfw -q add deny log tcp from any to any established > /sbin/ipfw -q add allow all from any to any out via isp0 keep-state > > /sbin/ipfw -q add deny log all from any to any > > -- > Rene de Vries http://www.tcja.nl mailto:rene@tcja.nl > > > To Unsubscribe: send mail to majordomo@FreeBSD.org > with "unsubscribe freebsd-hackers" in the body of the message > To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-hackers" in the body of the message