Thanks for the response. I think I understand the flow of the rules, which is why I pused the quick option on my pass rules. I don't want to use quick on the dropall rules, since that would defeat the purpose of having the accept rules. It makes more sense to me now to place the 'quick' pass rules before, so that it doesn't have to parse the rules for things I KNOW I want to accept. I've changed this, and rebooted the system, but I've still got the same problem.
After I made the change, I noticed that ipfstat shows the input packets as being blocked. So, I removed my few ipf rules, leaving JUST the ipnat rules, and I was able to get to the web page. So, I've added some rules back in, and I'm blocking once more. Perhaps someone might have some insight into what is wrong with these rules: --- BEGIN RULES --- pass in quick on dmfe0 proto tcp from any to <firewall> port = 80 pass in quick on dmfe0 proto udp from any to <firewall> port = 80 pass out quick on dmfe1 proto tcp from <webserver> to any port = 80 pass out quick on dmfe1 proto udp from <webserver> to any port = 80 block in all block out all --- END RULES --- The two systems <firewall> and <webserver> have their host names instead of the ip addresses (a possible problem?), though the hostname/ip are in the /etc/hosts file. Any more help would be greatly appreciated. Thanks again for the response. Steven -----Original Message----- From: Vedran Bender [mailto:[EMAIL PROTECTED]] Sent: Wednesday, December 04, 2002 3:22 PM To: 'Faulconer, Steven M.'; '[EMAIL PROTECTED]' Subject: RE: Simple (yet bothersome) configuration The answer is, IPF does not behave like FW-1 or FW NG by default. The way you have it configured right now, the parsing goes through all the rules. If you had a rule that said "ANY ANY ANY drop" and then a rule that said "ANY ANY ANY accept", all packets would flow, because that was the last rule that pertained to the condition. In order for your ruleset to work as designed, you need to add the "quick" keyword, which then stops parsing once a packet matches the rule. And a question for Mr. Reed, why does IPFilter behave in this way by default, rather than behaving like FW-1 and most other firewalls do? > -----Original Message----- > From: Faulconer, Steven M. [mailto:[EMAIL PROTECTED]] > Sent: Wednesday, December 04, 2002 14:56 PM > To: '[EMAIL PROTECTED]' > Subject: Simple (yet bothersome) configuration > > > Hello everyone, > > I've spent most of the day trying to get a very simple ipfilter system > setup. Here are the quick basics: > > <internet>----<dmfe0 (firewall) dmfe1>-----<web server> > > dmfe0 = x.x.x.x (real address) > dmfe1 = y.y.y.y (fake / non-routable address) > Web Server = a.a.a.a (fake / non-routable address) > > Both firewall and web server are running Solaris, firewall > uses IPFilter > 3.4.30 and Web Server is apache (1.3.27) > > Here are my rules: > > [/etc/opt/ipf/ipnat.conf] > rdr dmfe0 x.x.x.x/29 port 80 -> a.a.a.a port 80 tcp > > [/etc/opt/ipf/ipf.conf] > block in from any to any > block out from any to any > > pass in quick on dmfe0 proto tcp from any to a.a.a.a port = 80 > pass out on dmfe0 proto tcp from a.a.a.a to any port = 80 > > Now, I make a connection from the internet, which eventually > times out, but > while attemping to connect, I run 'ipnat -l' I get: > > List opf active MAP/Redirect filters: > rdr dmfe0 x.x.x.x/29 port 80 -> a.a.a.a port 80 tcp > > List of active sessions: > RDR a.a.a.a 80 <- -> x.x.x.x 80 [My.Inter.Net.Address 18432] > > Snoop running on the firewall shows: > My.Inter.Net.Address -> firewall HTTP C port=24249 > My.Inter.Net.Address -> firewall HTTP C port=24249 > My.Inter.Net.Address -> firewall HTTP C port=24249 > > Snoop on the web server shows nothing at all. > > Some please point me in the correct direction. I have 0 > experience with > ipfilter, though I have some with CheckPoint and > Raptor/Symantec. I imagine > it is something simple that I'm not understanding or I'm > missing. Any help > would be greatly appreciated. >
