From owner-freebsd-stable Fri May 18 3:40: 8 2001 Delivered-To: freebsd-stable@freebsd.org Received: from buzz.ichilton.co.uk (pc1-stoc3-0-cust147.mid.cable.ntl.com [62.254.91.147]) by hub.freebsd.org (Postfix) with ESMTP id 6864637B423 for ; Fri, 18 May 2001 03:39:56 -0700 (PDT) (envelope-from ian@buzz.ichilton.co.uk) Received: by buzz.ichilton.co.uk (Postfix, from userid 100) id 7328D1CE31E; Fri, 18 May 2001 11:39:54 +0100 (BST) Date: Fri, 18 May 2001 11:39:54 +0100 From: Ian Chilton To: freebsd-stable@FreeBSD.ORG Subject: natd locks me out - incl ipfw rules Message-ID: <20010518113954.A14402@buzz.ichilton.local> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline User-Agent: Mutt/1.3.15i Sender: owner-freebsd-stable@FreeBSD.ORG Precedence: bulk List-ID: X-Loop: FreeBSD.ORG Hello, I mailed this list over a week ago, because I setup a firewall and nat on a remote Freebsd-stable box, but when I added IPDIVERT into the kernel which I realiased it was needed, the box doesn't come back after reboot. Turns out, commenting the following out of rc.conf fixes it: natd_enable="YES" natd_flags="-f /etc/natd.conf" (by not come back, I mean that there is obviously no network access). It's took a week to get it back, but it hasn't done a lot, so the logs seem in tact, but I can't find anything. I have shown the relevent files below. I would appreciate any ideas you have into the problem, and also any comments on the firewall, improvements etc. Here is what I have in /etc/rc.conf: # Firewall and NAT: gateway_enable="YES" firewall_enable="YES" firewall_script="/etc/rc.firewall" firewall_logging="YES" natd_enable="YES" natd_flags="-f /etc/natd.conf" Here is my firewall rules (without the variables and ip's on the top :) # Stop spoofing ${fwcmd} add deny all from ${inet1}:${imask} to any in via ${oif} ${fwcmd} add deny all from ${inet2}:${imask} to any in via ${oif} ${fwcmd} add deny all from ${inet3}:${imask} to any in via ${oif} ${fwcmd} add deny all from ${onet}:${omask} to any in via ${iif1} ${fwcmd} add deny all from ${onet}:${omask} to any in via ${iif2} ${fwcmd} add deny all from ${onet}:${omask} to any in via ${iif3} # Stop RFC1918 nets on the outside interface ${fwcmd} add deny all from any to 10.0.0.0/8 via ${oif} ${fwcmd} add deny all from any to 172.16.0.0/12 via ${oif} ${fwcmd} add deny all from any to 192.168.0.0/16 via ${oif} # Stop draft-manning-dsua-03.txt (1 May 2000) nets (includes RESERVED-1, # DHCP auto-configuration, NET-TEST, MULTICAST (class D), and class E) # on the outside interface ${fwcmd} add deny all from any to 0.0.0.0/8 via ${oif} ${fwcmd} add deny all from any to 169.254.0.0/16 via ${oif} ${fwcmd} add deny all from any to 192.0.2.0/24 via ${oif} ${fwcmd} add deny all from any to 224.0.0.0/4 via ${oif} ${fwcmd} add deny all from any to 240.0.0.0/4 via ${oif} # Bandwidth Limiting (outgoing): # pipe 1 config bw 64Kbit/s queue 10Kbytes # add pipe 1 all from $(inet1}:$(imask) to any # add pipe 1 all from $(inet2}:$(imask) to any # add pipe 1 all from $(inet3}:$(imask) to any # add pipe 1 all from $(ipfw1) to any # add pipe 1 all from $(ipfw2) to any # add pipe 1 all from $(ipfw3) to any # Network Address Translation. case ${natd_enable} in [Yy][Ee][Ss]) if [ -n "${natd_interface}" ]; then ${fwcmd} add divert natd all from any to any via ${oif} fi ;; esac # Bandwidth Limiting (incoming): # pipe 2 config bw 64Kbit/s queue 10Kbytes # add pipe 2 all from any to $(inet1):$(imask) # add pipe 2 all from any to $(inet2):$(imask) # add pipe 2 all from any to $(inet3):$(imask) # add pipe 2 all from any to $(ipfw1) # add pipe 2 all from any to $(ipfw2) # add pipe 2 all from any to $(ipfw3) # Stop RFC1918 nets on the outside interface ${fwcmd} add deny all from 10.0.0.0/8 to any via ${oif} ${fwcmd} add deny all from 172.16.0.0/12 to any via ${oif} ${fwcmd} add deny all from 192.168.0.0/16 to any via ${oif} # Stop draft-manning-dsua-03.txt (1 May 2000) nets (includes RESERVED-1, # DHCP auto-configuration, NET-TEST, MULTICAST (class D), and class E) # on the outside interface ${fwcmd} add deny all from 0.0.0.0/8 to any via ${oif} ${fwcmd} add deny all from 169.254.0.0/16 to any via ${oif} ${fwcmd} add deny all from 192.0.2.0/24 to any via ${oif} ${fwcmd} add deny all from 224.0.0.0/4 to any via ${oif} ${fwcmd} add deny all from 240.0.0.0/4 to any via ${oif} # Allow own network: ${fwcmd} add pass all from ${oip} to ${onet}:${omask} ${fwcmd} add pass all from ${onet}:${omask} to ${oip} # Allow TCP through if setup succeeded ${fwcmd} add pass tcp from any to any established # Allow IP fragments to pass through ${fwcmd} add pass all from any to any frag # Allow setup of incoming ssh ${fwcmd} add pass tcp from any to ${oip} 22 setup # Allow IMCP on Internal Networks: ${fwcmd} add allow icmp from any to any via ${iif1} ${fwcmd} add allow icmp from any to any via ${iif2} ${fwcmd} add allow icmp from any to any via ${iif3} # Allow outgoing ping's: ${fwcmd} add allow icmp from any to any icmptypes 8 out via ${oif} ${fwcmd} add allow icmp from any to any icmptypes 0 in via ${oif} # Allow incoming ping's: ${fwcmd} add allow icmp from any to any icmptypes 0 out via ${oif} ${fwcmd} add allow icmp from any to any icmptypes 8 in via ${oif} # Allow traceroute: ${fwcmd} add allow icmp from any to any icmptypes 3,4,11,12 via ${oif} # Disallow all other IMCP: ${fwcmd} add deny log icmp from any to any # Not sure about this yet, so left commented :) # ${fwcmd} add unreach filter-prohib log icmp from any to any # Reject&Log all setup of incoming connections from the outside ${fwcmd} add deny log tcp from any to any in via ${oif} setup # Allow setup of any other TCP connection ${fwcmd} add pass tcp from any to any setup # Allow NTP queries out in the world ${fwcmd} add pass udp from ${oip} to any 123 keep-state # Everything else is denied by default, unless the # IPFIREWALL_DEFAULT_TO_ACCEPT option is set in the kernel # config. Thanks! Bye for Now, Ian \|||/ (o o) /-----------------------------ooO-(_)-Ooo----------------------------\ | Ian Chilton E-Mail: ian@ichilton.co.uk | | IRC Nick: GadgetMan Backup: ichilton@www.linux.org.uk | | ICQ: 16007717 / 104665842 Web : http://www.ichilton.co.uk | |--------------------------------------------------------------------| | For people who like peace and quiet: a phoneless cord | \--------------------------------------------------------------------/ To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-stable" in the body of the message