Date: Sun, 29 Nov 2015 12:03:21 +1100 From: Graham Menhennitt <graham@menhennitt.com.au> To: =?UTF-8?Q?Thom=c3=a1s_S._Bregolin?= <thomas5th@gmail.com> Cc: freebsd-ipfw@freebsd.org Subject: Re: connecting a PS4 via IPFW Message-ID: <565A4ED9.2080102@menhennitt.com.au> In-Reply-To: <20151128094753.GA5426@bloo> References: <5655405C.1060301@menhennitt.com.au> <20151127180317.GA3661@host> <56592B3D.5070800@menhennitt.com.au> <20151128094753.GA5426@bloo>
next in thread | previous in thread | raw e-mail | index | archive | help
On 28/11/2015 20:47, Thom=E1s S. Bregolin wrote:
> Besides the redirect_port option, you still need rules allowing traffic
> in to those ports. Excuse-me if you've done that already (I have no way
> of knowing).
>
>
> Sat, Nov 28, 2015 at 03:19:09PM +1100, Graham Menhennitt:
>> On 28/11/2015 05:03, Thomas wrote:
>>> Wed, Nov 25, 2015 at 04:00:12PM +1100, Graham Menhennitt:
>>>> I have a box running FreeBSD 10-stable that I use as a
>>>> router/firewall/NAT. It runs IPFW and uses kernel NAT. My son is nag=
ging
>>>> me about playing multi-player online games on his Sony PS4.
>>>>
>>>> Giving up on that, I'm now trying to enable port forwarding -
>>>> apparently, this will fix it. I've allocated the PS4 a static IP add=
ress
>>>> on my LAN. I need to port forward TCP ports 80, 443, 1935, 3478-3480=
,
>>>> and UDP ports 3478-3479. I've tried the following command:
>>>>
>>>> ipfw nat 1 config if re1 same_ports \
>>>> redirect_port tcp ${PS4_LAN_ADDRESS}:1935 1935 \
>>>> redirect_port tcp ${PS4_LAN_ADDRESS}:3478 3478 \
>>>> redirect_port tcp ${PS4_LAN_ADDRESS}:3479 3479 \
>>>> redirect_port tcp ${PS4_LAN_ADDRESS}:3480 3480 \
>>>> redirect_port udp ${PS4_LAN_ADDRESS}:3478 3478 \
>>>> redirect_port udp ${PS4_LAN_ADDRESS}:3479 3479
>>>>
>>>>
Thanks again, Thomas and Ian.
I have attempted to let those ports in, but I'm not really sure what I'm
doing. My firewall rules are below - could you please have a look. I
allow almost all UDP and I've added rules for the four relevant TCP
ports. As Ian suggested, I've removed ports 80 and 443 from the redirects=
.
Thanks,
Graham
# stop spoofing
add deny all from LAN_NET to any in via OUTSIDE_IF
add deny all from WIFI_NET to any in via OUTSIDE_IF
# allow anything on the LAN
add allow all from any to any via LAN_IF
# and from the VPN
add allow all from any to any via VPN_IF
# allow anything from the wireless network to here and the outside world
(but not to the LAN)
add allow ip from any to me via WIFI_IF
add allow ip from any to not LAN_NET via WIFI_IF
# create a table of addresses to block
table 1 flush
# add RFC1918 nets
table 1 add 10.0.0.0/8
table 1 add 172.16.0.0/12
table 1 add 192.168.0.0/16
# and draft-manning-dsua-03.txt nets
table 1 add 0.0.0.0/8
table 1 add 169.254.0.0/16
table 1 add 192.0.2.0/24
table 1 add 224.0.0.0/4
table 1 add 240.0.0.0/4
# stop entries in the table on the outside interface
add deny all from table(1) to any via OUTSIDE_IF
# allow setup of incoming SSH, IMAPS, and OpenVPN
add allow tcp from any to me ssh setup
add allow tcp from any to me imaps setup
add allow tcp from any to me openvpn setup
add allow udp from any to me openvpn
# allow IPP and SMTP from wireless
add allow ip from any to LAN_NET dst-port printer setup via WIFI_IF
add allow ip from any to me dst-port ipp setup via WIFI_IF
add allow ip from any to me dst-port smtp setup via WIFI_IF
# allow ICMP & UDP
# ..except UPnP discovery
add deny udp from any to any 1900
# .. and SIP in from outside
add deny udp from any to any in via OUTSIDE_IF dst-port 5060-5069
#add allow igmp from any to any
add allow icmp from any to any
add allow udp from any to any
# Network Address Translation.
nat 1 config if OUTSIDE_IF same_ports deny_in
add nat 1 ip4 from any to any via OUTSIDE_IF
# Allow TCP through if setup succeeded
add pass tcp from any to any established
# Allow IP fragments to pass through
add pass all from any to any frag
# allow TCP ports needed for PS4
add allow tcp from any to any 1935 in via OUTSIDE_IF setup
add allow tcp from any to any 3478 in via OUTSIDE_IF setup
add allow tcp from any to any 3479 in via OUTSIDE_IF setup
add allow tcp from any to any 3480 in via OUTSIDE_IF setup
# reject all setup of incoming connections from the outside
add deny tcp from any to any in via OUTSIDE_IF setup
# reject all setup of incoming connections from the wireless
add deny tcp from any to any in via WIFI_IF setup
# Allow setup of any other TCP connection
add pass tcp from any to any setup
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?565A4ED9.2080102>