Ok, when I changed my main rule to: pass in quick on dmfe0 proto tcp/udp from any to any port = 80 keep state
I was able to get to the web server from the internet. So, using the firewall's hostname was not the right solution there. Then I thought about something I read, that ipnat happens BEFORE ipf, so, by the time it hit the rules, the ipnat had already changed the addresses, so I had to tell ipf to allow the connections to the webserver. This appears to work correctly. I have a question though. Is it possible to see a list of all of the currently applied rules to ipf? I know ipnat has a -l option, but ipf doesn't (at least have a -l option). I ask on the list because the configuration of my firewall does not have 'man' available. Thanks again to everyone who responded, at least it got me thinking! Steven -----Original Message----- From: Phil Dibowitz [mailto:[EMAIL PROTECTED]] Sent: Wednesday, December 04, 2002 4:03 PM To: '[EMAIL PROTECTED]' Subject: Re: Simple (yet bothersome) configuration Faulconer, Steven M. wrote: > pass in quick on dmfe0 proto tcp from any to <firewall> port = 80 > pass in quick on dmfe0 proto udp from any to <firewall> port = 80 > pass out quick on dmfe1 proto tcp from <webserver> to any port = 80 > pass out quick on dmfe1 proto udp from <webserver> to any port = 80 > > block in all > block out all This won't solve your problem, but you'll have a much more effecient ruleset with this: ---------------------------- pass in quick on dmfe0 proto tcp/udp from any to <firewall> port = 80 keep state block in all block out all ---------------------------- Advantages: - less rules - more secure, it follows the state - will allow any related ICMPs such as type 3/4 needed for Path MTU Discovery -- Phil Dibowitz [EMAIL PROTECTED] Freeware and Technical Pages Insanity Palace of Metallica http://home.earthlink.net/~jaymzh666/ http://www.ipom.com/ "They that can give up essential liberty to obtain a little temporary safety deserve neither liberty nor safety." - Benjamin Franklin, 1759
