Date: Thu, 1 Aug 2002 10:44:38 +0000 From: Philip Reynolds <philip.reynolds@rfc-networks.ie> To: freebsd-ipfw@freebsd.org Subject: Re: ruleset q-n Message-ID: <20020801104438.A28257@rfc-networks.ie> In-Reply-To: <015c01c238dd$a8bc8450$0100a8c0@ilya>; from mail@krel.org on Wed, Jul 31, 2002 at 05:59:55PM -0400 References: <015c01c238dd$a8bc8450$0100a8c0@ilya>
next in thread | previous in thread | raw e-mail | index | archive | help
Ilya <mail@krel.org> 41 lines of wisdom included: > I have a problem, with smtp traffic, in my ipfw.log i see alot of 65534 denied packets either from foreign_ip port 25, or to my internet_ip port 25, even though all emails seem to go through. > here is my ruleset: > <snip rules> > > i had same problem with DNS and solved it by specifically alowing DNS traffic in all directions, but i dont think thats the right way. > Why would smtp traffic hit the last deny rule at all? > for example this is an entry from log: > Jul 31 17:52:57 mybox ipfw: 65534 Deny TCP 216.136.204.119:20028 $internet_ip:25 in via ed0 > but the email did came through. it almost looks like the connection is closed, and than mx2.FreeBSD.org tries to connect to port 25 again. > why wouldnt it be able to do so? why didnt this packet hit rule 500 ? and instead hit 65534? I don't have the time to look at your problem in-depth at the moment, but perhaps look at the following: http://resources.rfc-networks.ie/freebsd/ipfw_nat_stateful.phtml As you seem to be using NAT and stateful firewalling. After coming across problems with NAT and stateful firewalling, the above solution worked for me. If you're still having problems after completing the instructions (there aren't many I know, but I'm just starting it), paste the output for ipfw -d list, during the connections, and more verbose logs, plus an analysis of the traffic would be nice as well (see tcpdump(1)). -- Philip Reynolds | Technical Director philip.reynolds@rfc-networks.ie | RFC Networks Ltd. http://www.rfc-networks.ie | +353 (0)1 8832063 To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-ipfw" in the body of the message
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20020801104438.A28257>