Skip site navigation (1)Skip section navigation (2)
Date:      Tue, 26 Feb 2002 02:09:56 +0100
From:      Florian Nigsch <flo@nigsch.com>
To:        freebsd-questions@freebsd.org
Subject:   private lan + natd: what to divert
Message-ID:  <20020226020956.A38543@nigsch.com>

next in thread | raw e-mail | index | archive | help

--X1bOJ3K7DJ5YkBrT
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable

Hi all,

I just spent the whole austrian evening and part of the night=20
setting up a new firewall for my home lan. What a job....

I have a FreeBSD 4.5-STABLE with two ethernet cards ed0 and ed1

ed0: 1.2.3.4
ed1: 192.168.2.1

I have natd running with natd.conf reading:

deny_incoming no
log_denied
use_sockets
same_ports
unregistered_only

and a firewall script wit the following rules:

add 100 allow ip from any to any via lo0
 ... some anti-spoof rules ...
add 4400 skipto 5000 ip from 192.168.2.0/24 to 1.2.3.4
add 4500 divert 8668 ip from 192.168.2.0/24 to not 192.168.2.0/24
add 4600 divert 8668 ip from not 192.168.2.0/24 to 1.2.3.4

add 5000 check-state
add allow tcp from any to any established
add allow ip from any to any via ed1 keep-state
add allow ip from 1.2.3.4 to any keep-state
=2E.. some other rules ...
add deny 65530 deny log ip from any to any

-> With these rules I am not able to browse websites from behind the
firewall. However, and that I find a bit confusing, I can do a=20
mailcheck at my mailserver with Eudora (with TLS). I can ping=20
outside hosts (like www.yahoo.com), name resolution is working
but I can't seem to get www access working.

-> If I change the divert rules instead of two separate rules to
add 4500 divert 8668 ip from any to any via ed0
everything is working just wonderful. This rule works fine but it
also diverts the traffic for the public IP address, which isn't
really necessary.

-> I think that if each connection is a dynamic one, is there the
need to have a rule to allow established tcp packets?

What is wrong with those two divert rules? Shouldn't they work as I
expect them to? ;)
Or could it be that it has something to do with the dynamic rules?

Thanks for any comments in advance,

flo


--=20


---
Florian Nigsch <flo@nigsch.com>
http://flo.nigsch.com/
PGP key: http://flo.nigsch.com/fnigsch.asc

--X1bOJ3K7DJ5YkBrT
Content-Type: application/pgp-signature
Content-Disposition: inline

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.0.6 (FreeBSD)
Comment: For info see http://www.gnupg.org

iD8DBQE8euBjFB5yp9/3jW0RAtt0AJ97JFjgYwTIH3wpgcyhSbK2W7WnFACeISzY
fxyvv4JFe29TN6LArDK0X/E=
=JoXa
-----END PGP SIGNATURE-----

--X1bOJ3K7DJ5YkBrT--

To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-questions" in the body of the message




Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20020226020956.A38543>