Hi Bruno and Guys/Gals Sorry I have taken so long to reply but things got a little busy, but to answer your questions.
sis0 is my external interface to the internet wi0(wireless) and sis1 are my internal interface I couldnt get your number 1,2,3 running without a bit more playing to see what you are requesting but I cut and pasted the line from my log file that shows IPFilter is actually blocking my nmap scan, it does this to internal or external interfaces. Feb 12 15:43:41 optusnet ipmon[58]: 15:43:41.261130 sis0 @0:4 b c16410.fernt1.vic.optusnet.com.au[210.49.202.29],38664 -> smarthome.smart.net.au[203.63.238.10],http PR tcp len 20 40 -A 2495610883 3240739687 4096 OUT It gives certain info there but I have no idea what it means, but according to someone else the reason for my scans being blocked out are because of my "flags S" in my out line. I have just tested this and confirmed this to be true. My problem now is that if I dont have this line there my state table fill's up and I have to re-sync it, how do I get around this problem ?? I commented out the line "block out quick on sis0 from any to any" and it made no difference. Thanks for all your help Matt. ----- Original Message ----- From: "Bruno Saverio Delbono" <[EMAIL PROTECTED]> To: "Matt Pearce" <[EMAIL PROTECTED]>; <[EMAIL PROTECTED]> Sent: Monday, February 10, 2003 4:54 AM Subject: Re: IPFilter, Nmap & FreeBSD 4.7 > Hmm... > > Making, drinking tea and reading an opus magnum from Matt Pearce: > >The reason I have the # before the portmap is because I cant use ping from a > >client machine if it is there, and being as I was only playing with it and > >dont need it I have disabled that particular bit. > > ok.. I think we need to further debug this.. Can you send logs of ipf when > you try to open outgoing connection with nmap? (Please also include): > 1) ipmon -o -S > 2) ipmon -o -I > 3) ipmon -o -N > > > >5 block out quick on sis0 from any to any > > Why above? Can try 'n comment it out and see if it works? > > Plus, I'm trying to understand your network. > > sis0 - external interface > sis1/wi0 - internal interface. > > When you try to scan via nmap which device does it use for its default > route? (Perhaps tcpdump while you do the nmap would give more clear idea on > what's going on). > > PS - Can you nmap any other host? > > -Bruno > > ---------------------------------------------------------------------- > > Our company accepts no liability for the content of this email, or for > the consequences of any actions taken on the basis of the information > provided, unless that information is subsequently confirmed in > writing. If you are not the intended recipient you are notified that > disclosing, copying, distributing or taking any action in reliance on > the contents of this information is strictly prohibited. > http://www.wf0.com > ---------------------------------------------------------------------- > > > > > >
