>gateway_enable="YES"
>はいらないんでしたっけ?

あ、まさにそれです!

ありがとうございます。

>古いマシンのrc.conf には書いてあったんじゃないかと思いますが…。
書いてなくて動いてました。(なぜでしょうか?)
(FreeBSD 4.? のころから動かしてました)

>ipf の方はどんなエラーメッセージか教えてもらえばなにかわかるかも、です。

今日、なんとなく、

# /sbin/ipf -FA -Z /etc/ipf.rules

を実行したら、特にエラーがでませんでした。

bad packets:            in 0    out 0
 input packets:         blocked 0 passed 1148 nomatch 960 counted 0
output packets:         blocked 0 passed 1084 nomatch 856 counted 0
 input packets logged:  blocked 0 passed 0
output packets logged:  blocked 0 passed 0
 packets logged:        input 0-0 output 0-0

エラーが出たときはメッセージは忘れましたが

?(数字) IOCTL なんとか File not found
(が複数)
でした

しかし、

# ipfstat -io

を実行すると

empty list for ipfilter(out)
empty list for ipfilter(in)

となります。

今、動かしているipf.rulesはこれです。
-----------------
#pass in quick all
#pass out quick all

# smb blocks

block in quick proto tcp/udp from any to 固定IP/32 port = 113
block in quick proto tcp/udp from any to 固定IP/32 port = 137
block in quick proto tcp/udp from any to 固定IP/32 port = 138
block in quick proto tcp/udp from any to 固定IP/32 port = 139
block in quick proto tcp/udp from any to 固定IP/32 port = 445
block in quick proto tcp/udp from any to 固定IP/32 port = 1512
block in quick proto tcp/udp from any to 固定IP/32 port = 3389

# localnet block
#block in log quick on ng0 from 192.168.1.0/24 to any group 200

# multicast block
#block in log quick on ng0 from 224.0.0.0/4 to any group 200

# smtp allow
pass in quick on ng0 proto tcp from any to any port = 25 flags S/SA keep state 
group 200

# pop3 allow
#pass in quick on ng0 proto tcp from any to any port = 110 flags S/SA group 200

# www allow
pass in quick on ng0 proto tcp from any to any port = 80 flags S/SA group 200

# ssl allow
pass in quick on ng0 proto tcp from any to any port = 443 flags S/SA group 200

# dns allow
pass in quick on ng0 proto tcp from any to any port = 53 flags S/SA group 200
pass in quick on ng0 proto udp from any to any port = 53 group 200

# localnet allows
pass out on em0  from 192.168.1.0/24 to 192.168.1.0/24 group 350


参考までに、FreeBSD 6.2で動いていたのはこれです。
(カーネルでDEFAULT_BLOCKにて)
-----------------
#block in quick from any to any with ipopts frag
#block in quick proto tcp from any to any with short
#block in quick from 169.254.0.0/16 to any

pass in quick all
pass out quick all

# smb block

block in quick proto tcp/udp from any to 固定IP/32 port = 113
block in quick proto tcp/udp from any to 固定IP/32 port = 137
block in quick proto tcp/udp from any to 固定IP/32 port = 138
block in quick proto tcp/udp from any to 固定IP/32 port = 139
block in quick proto tcp/udp from any to 固定IP/32 port = 445
block in quick proto tcp/udp from any to 固定IP/32 port = 1512


block in quick proto tcp/udp from any to 固定IP/32 port = 3389

# localnet block
block in log quick on ng0 from 192.168.1.0/24 to any group 200

# multicast block
block in log quick on ng0 from 224.0.0.0/4 to any group 200

# smtp allow
pass in quick on ng0 proto tcp from any to any port = 25 flag S keep state 
group 200

# pop3 allow
pass in quick on ng0 proto tcp from any to any port = 110 flag S keep state 
group 200

# www allow
pass in quick on ng0 proto tcp from any to any port = 80 flag S keep state 
group 200

# ssl allow
pass in quick on ng0 proto tcp from any to any port = 443 flag S keep state 
group 200

# dns allow
pass in quick on ng0 proto tcp from any to any port = 53 flag S keep state 
group 200
pass in quick on ng0 proto udp from any to any port = 53 flag S keep state 
group 200

# localnet allows
pass out on bge0  from 192.168.1.0/24 to 192.168.1.0/24 group 350

-----
p.s.

telnetが開いていますが、外部から来ますと、/usr/local/bin/sl が走ります。汗
ftpは開けておく必要があります。
sshdは有効になっていません。(あくまでlocalnetからのtelnetのみなので)


なな <nana0...@inter7.jp>

メールによる返信