Understanding the concept behind incoming versus the outgoing may be key to
solving this problem. Unfortunately, it is not as clearcut as it would at
first seem.
The short of it is, both sets of pass rules need to be "pass in".
The following diagram may help understand this important concept:
> pass in quick on dmfe0 proto tcp from any to <firewall> port = 80
> pass in quick on dmfe0 proto udp from any to <firewall> port = 80
incoming outgoing
incoming outgoing
outside world -------> dmfe0 -------> (inside the machine)
-------> dfme1 ------->
So then, to enable the web server to go out,
outgoing incoming
outgoing incoming
outside world <------- dmfe0 <------- (inside the machine)
<------- dmfe1 <-------
This is best explained in "CheckPoint security courseware: Introduction to
FireWall-1 Version 4.0 Student User Guide", pages 193 - 196.
If you have this literature, I encourage you to assimilate it.
> -----Original Message-----
> From: Faulconer, Steven M. [mailto:[EMAIL PROTECTED]]
> Sent: Wednesday, December 04, 2002 15:47 PM
> To: 'Vedran Bender'
> Cc: '[EMAIL PROTECTED]'
> Subject: RE: Simple (yet bothersome) configuration
>
>
> Thanks for the response.
>
> I think I understand the flow of the rules, which is why I
> pused the quick
> option on my pass rules. I don't want to use quick on the
> dropall rules,
> since that would defeat the purpose of having the accept
> rules. It makes
> more sense to me now to place the 'quick' pass rules before,
> so that it
> doesn't have to parse the rules for things I KNOW I want to
> accept. I've
> changed this, and rebooted the system, but I've still got the
> same problem.
>
> After I made the change, I noticed that ipfstat shows the
> input packets as
> being blocked. So, I removed my few ipf rules, leaving JUST
> the ipnat rules,
> and I was able to get to the web page. So, I've added some
> rules back in,
> and I'm blocking once more. Perhaps someone might have some
> insight into
> what is wrong with these rules:
>
> --- BEGIN RULES ---
>
> pass in quick on dmfe0 proto tcp from any to <firewall> port = 80
> pass in quick on dmfe0 proto udp from any to <firewall> port = 80
> pass out quick on dmfe1 proto tcp from <webserver> to any port = 80
> pass out quick on dmfe1 proto udp from <webserver> to any port = 80
>
> block in all
> block out all
>
> --- END RULES ---
>
> The two systems <firewall> and <webserver> have their host
> names instead of
> the ip addresses (a possible problem?), though the
> hostname/ip are in the
> /etc/hosts file.
>
> Any more help would be greatly appreciated.
>
> Thanks again for the response.
>
> Steven
