From owner-freebsd-security Tue Nov 14 16:37:18 2000 Delivered-To: freebsd-security@freebsd.org Received: from Awfulhak.org (tun.AwfulHak.org [194.242.139.173]) by hub.freebsd.org (Postfix) with ESMTP id 2625E37B479 for ; Tue, 14 Nov 2000 16:37:15 -0800 (PST) Received: from hak.lan.Awfulhak.org (root@hak.lan.awfulhak.org [172.16.0.12]) by Awfulhak.org (8.11.1/8.11.1) with ESMTP id eAF0XZF16557; Wed, 15 Nov 2000 00:33:35 GMT (envelope-from brian@hak.lan.Awfulhak.org) Received: from hak.lan.Awfulhak.org (brian@localhost [127.0.0.1]) by hak.lan.Awfulhak.org (8.11.1/8.11.1) with ESMTP id eAEIoXY00540; Tue, 14 Nov 2000 18:50:33 GMT (envelope-from brian@hak.lan.Awfulhak.org) Message-Id: <200011141850.eAEIoXY00540@hak.lan.Awfulhak.org> X-Mailer: exmh version 2.2 06/23/2000 with nmh-1.0.4 To: "Nuno Teixeira" Cc: freebsd-security@FreeBSD.ORG, brian@Awfulhak.org Subject: Re: PPP NAT Gateway security In-Reply-To: Message from "Nuno Teixeira" of "Mon, 13 Nov 2000 22:50:05 GMT." <00c801c04dc4$12a89220$0200a8c0@n2> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Date: Tue, 14 Nov 2000 18:50:33 +0000 From: Brian Somers Sender: owner-freebsd-security@FreeBSD.ORG Precedence: bulk X-Loop: FreeBSD.org > Hello to all, > > Recently I configured a FreeBSD box to act like a gateway for my NT > workstation computers at my office have access to the Internet. I configured > it in this way: > > ppp -background -nat MYISP > > It works OK and I have access to a lot of Internet services. > > My question is: do I need to configure this machine with firewall, so I can > protect my internal network from the outside net? > > If I need so, please tell me a good place to start with firewalls for > FreeBSD. If you just want to deny incoming connections, you can ``nat deny_incoming yes'' and ``nat target MYADDR'' in your config (although *MAKE SURE* you've got a recent version of ppp - you can get it via http://www.Awfulhak.org/ppp.html - if in doubt, test it from the outside). Read the section on that command in the man page too.... If you wish to be more selective, you need to use either ``set filter'' in ppp or the external ipfw(8) program. > Thanks very much, > > Nuno Teixeira -- Brian Don't _EVER_ lose your sense of humour ! To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-security" in the body of the message