From owner-freebsd-questions@FreeBSD.ORG Tue Jul 26 19:44:13 2005 Return-Path: X-Original-To: FreeBSD-questions@freebsd.org Delivered-To: FreeBSD-questions@freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id 5343516A41F for ; Tue, 26 Jul 2005 19:44:13 +0000 (GMT) (envelope-from eric@pretorious.net) Received: from mail.leaguehost.net (node-423a611b.sjc.onnet.us.uu.net [66.58.97.27]) by mx1.FreeBSD.org (Postfix) with ESMTP id 2069843D45 for ; Tue, 26 Jul 2005 19:44:11 +0000 (GMT) (envelope-from eric@pretorious.net) Received: from [192.168.4.115] (adsl-69-227-121-18.dsl.scrm01.pacbell.net [69.227.121.18]) by mail.leaguehost.net (Postfix) with ESMTP id 7F321BF64 for ; Tue, 26 Jul 2005 12:55:17 -0700 (PDT) From: Eric Pretorious To: FreeBSD-questions@freebsd.org Date: Tue, 26 Jul 2005 12:19:07 -0700 User-Agent: KMail/1.7.1 MIME-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Content-Disposition: inline Message-Id: <200507261219.08111.eric@pretorious.net> Cc: Subject: ipfw: deny traffic between interfaces X-BeenThere: freebsd-questions@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list Reply-To: eric@pretorious.net List-Id: User questions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 26 Jul 2005 19:44:13 -0000 I'm using FreeBSD 4.10 as a masquerading firewall for three private networks and want to restrict traffic between each interface (kind of like VLAN's). The firewall's interfaces are configured as such: sis0 public rl0 192.168.1.1 fxp0 192.168.2.1 sis1 192.168.4.1 ...and ipfw is configured as such: 00050 13453519 8660535275 divert 8668 ip from any to any via sis0 00100 490 81262 allow ip from any to any via lo0 00200 0 0 deny ip from any to 127.0.0.0/8 00300 0 0 deny ip from 127.0.0.0/8 to any 65000 26955802 17357286222 allow ip from any to any 65535 0 0 deny ip from any to any How can I accomplish this with ipfw? (I thought that something like `ipfw add 400 deny ip from rl0 to not sis0` would do the job but it didn't.) -- Eric P., Truckee, CA