The answer is, IPF does not behave like FW-1 or FW NG by default. The way you have it configured right now, the parsing goes through all the rules. If you had a rule that said "ANY ANY ANY drop" and then a rule that said "ANY ANY ANY accept", all packets would flow, because that was the last rule that pertained to the condition.
In order for your ruleset to work as designed, you need to add the "quick" keyword, which then stops parsing once a packet matches the rule. And a question for Mr. Reed, why does IPFilter behave in this way by default, rather than behaving like FW-1 and most other firewalls do? > -----Original Message----- > From: Faulconer, Steven M. [mailto:[EMAIL PROTECTED]] > Sent: Wednesday, December 04, 2002 14:56 PM > To: '[EMAIL PROTECTED]' > Subject: Simple (yet bothersome) configuration > > > Hello everyone, > > I've spent most of the day trying to get a very simple ipfilter system > setup. Here are the quick basics: > > <internet>----<dmfe0 (firewall) dmfe1>-----<web server> > > dmfe0 = x.x.x.x (real address) > dmfe1 = y.y.y.y (fake / non-routable address) > Web Server = a.a.a.a (fake / non-routable address) > > Both firewall and web server are running Solaris, firewall > uses IPFilter > 3.4.30 and Web Server is apache (1.3.27) > > Here are my rules: > > [/etc/opt/ipf/ipnat.conf] > rdr dmfe0 x.x.x.x/29 port 80 -> a.a.a.a port 80 tcp > > [/etc/opt/ipf/ipf.conf] > block in from any to any > block out from any to any > > pass in quick on dmfe0 proto tcp from any to a.a.a.a port = 80 > pass out on dmfe0 proto tcp from a.a.a.a to any port = 80 > > Now, I make a connection from the internet, which eventually > times out, but > while attemping to connect, I run 'ipnat -l' I get: > > List opf active MAP/Redirect filters: > rdr dmfe0 x.x.x.x/29 port 80 -> a.a.a.a port 80 tcp > > List of active sessions: > RDR a.a.a.a 80 <- -> x.x.x.x 80 [My.Inter.Net.Address 18432] > > Snoop running on the firewall shows: > My.Inter.Net.Address -> firewall HTTP C port=24249 > My.Inter.Net.Address -> firewall HTTP C port=24249 > My.Inter.Net.Address -> firewall HTTP C port=24249 > > Snoop on the web server shows nothing at all. > > Some please point me in the correct direction. I have 0 > experience with > ipfilter, though I have some with CheckPoint and > Raptor/Symantec. I imagine > it is something simple that I'm not understanding or I'm > missing. Any help > would be greatly appreciated. >
