Date: Thu, 25 Jan 2001 21:50:43 +0300 From: Odhiambo Washington <wash@iconnect.co.ke> To: freebsd-questions@freebsd.org Cc: wizard@sybaweb.co.za Subject: Re: IPFW blocking users Message-ID: <20010125215043.A70366@poeza.iconnect.co.ke> In-Reply-To: <010901c086f8$ba60eea0$0200a8c0@ait.co.za>; from "Peter Salvage" on Thu, Jan 25, 2001 at 08:00:40PM %2B0200 References: <010901c086f8$ba60eea0$0200a8c0@ait.co.za>
next in thread | previous in thread | raw e-mail | index | archive | help
* Peter Salvage <wizard@sybaweb.co.za> [20010125 21:01]: writing on the subject 'IPFW blocking users'
Peter> Hi all
Peter>
Peter> If this is an inappropriate forum, please point me (gently) in the correct
Peter> direction.
Peter>
Peter> <wits end>
Peter> Setup:
Peter> 2 x /24 networks, both variably subnetted
Peter> PortMaster PM2E30 for dialup
Peter> FreeBSD running IPFW rules
Peter>
Peter> Problem:
Peter> None of our dialup users can get past our home page. They can log onto our
Peter> authentication server and receive/send mail fine though.
The gurus will want to see your ipfw rules, but I can guess that you are
not allowing them any access outside your network, right?
I'm just in the process of reading about this very interesting tool called
IPFW. My advise to you would be a novice one but I see in the man page of
ipfw:
A first and efficient way to limit access (not using dynamic rules) is
the use of the following rules:
ipfw add allow tcp from any to any established
ipfw add allow tcp from net1 portlist1 to net2 portlist2 setup
ipfw add allow tcp from net3 portlist3 to net3 portlist3 setup
...
ipfw add deny tcp from any to any
The first rule will be a quick match for normal TCP packets, but it
will
not match the initial SYN packet, which will be matched by the setup
rules only for selected source/destination pairs. All other SYN
packets
will be rejected by the final deny rule.
###
Some of your rules might be conflicting: Show the rules to the gurus....
-Wash
--
Odhiambo Washington Inter-Connect Ltd.,
wash@iconnect.co.ke 5th Flr Furaha Plaza
Tel: 254 11 222604 Nkrumah Rd.,
Fax: 254 11 222636 PO Box 83613 MOMBASA, KE.
If all else fails, immortality can always be assured by spectacular error.
-John Kenneth Galbraith
(contributed by Chris Johnston)
To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-questions" in the body of the message
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20010125215043.A70366>