From owner-freebsd-ipfw@FreeBSD.ORG Tue Apr 15 07:20:54 2003 Return-Path: Delivered-To: freebsd-ipfw@freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id 01AFF37B401 for ; Tue, 15 Apr 2003 07:20:54 -0700 (PDT) Received: from news.lucky.net (news.lucky.net [193.193.193.102]) by mx1.FreeBSD.org (Postfix) with ESMTP id C44E543FBF for ; Tue, 15 Apr 2003 07:20:48 -0700 (PDT) (envelope-from vit@volia.com) Received: (from mail@localhost) by news.lucky.net (8.Who.Cares/8.Who.Cares) id RHZ14315 for freebsd-ipfw@freebsd.org; Tue, 15 Apr 2003 17:20:44 +0300 (envelope-from vit@volia.com) From: "Belov V." To: freebsd-ipfw@freebsd.org Date: Tue, 15 Apr 2003 15:53:30 +0300 Organization: TopNET NEWS Server (news.top.net.ua) Message-ID: <1050411211.383975@smtp.top.net.ua> X-Trace: vega.esico.lucky.net 1050411217 94529 193.109.60.198 (15 Apr 2003 12:53:37 GMT) X-Complaints-To: usenet@news.esico.net X-Priority: 3 X-MSMail-Priority: Normal X-Newsreader: Microsoft Outlook Express 6.00.2800.1106 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1106 Cache-Post-Path: smtp.top.net.ua!unknown@193.109.61.226 X-Cache: nntpcache 3.0.1 (see http://www.nntpcache.org/) MIME-Version: 1.0 X-Verify-Sender: verified Subject: allow vpn clients to connect to internal vpn server X-BeenThere: freebsd-ipfw@freebsd.org X-Mailman-Version: 2.1.1 Precedence: list List-Id: IPFW Technical Discussions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 15 Apr 2003 14:20:54 -0000 Hi My privat net is 192.168.0.0/24 and has Win VPN server in it. Natd has redirection: redirect_port tcp 192.168.0.1:1723 1723 What should be added to allow external vpn clients to connect to my internal vpn server? My current BSD router has the following ipfw rules: add allow ip from any to any via lo0 add deny all from any to 127.0.0.0/8 add deny all from 127.0.0.0/8 to any add deny all from 192.168.0.0/24 to any in recv de0 add deny all from any to 10.0.0.0/8 via de0 add deny all from any to 172.16.0.0/12 via de0 add deny all from any to 192.168.0.0/16 via de0 add deny all from any to 0.0.0.0/8 via de0 add deny all from any to 169.254.0.0/16 via de0 add deny all from any to 192.0.2.0/24 via de0 add deny all from any to 224.0.0.0/4 via de0 add deny all from any to 240.0.0.0/4 via de0 add deny tcp from any to any 137-139 via de0 add deny tcp from any to any 137-139 via de0 add fwd 192.168.0.10,3128 tcp from 192.168.0.0/24 to any 80 add divert 8668 all from any to any via de0 add pass tcp from any to any established add pass ip from any to any frag add pass tcp from any to ip_of_external_interface 25 setup add pass tcp from any to any 1723 setup add pass tcp from any to any 4899 setup add pass tcp from any to ip_of_external_interface 53 setup add pass udp from any to ip_of_external_interface 53 add pass udp from ip_of_external_interface 53 to any add deny log tcp from any to any in via de0 setup add pass tcp from any to any setup add pass udp from any to any 53 keep-state