Hello,
I've got a FreeBSD machine acting as firewall and nat gateway for an
internal network. Everything is working except razor needed for mail spam
scanning and winmx. I'm hoping someone can help with one or both of these
issues.
The more critical one first, razor. I've got a natted mail server on
192.168.0.3. I want to run razor from it, yet when i start razor it can't
contact any razor servers, i keep getting denied, firewall is definitely the
issue. Here are my razor rules.
ipf.rules:
# pass razor checks from mail server
pass in quick on ep1 proto tcp from 192.168.0.0/24 to 192.168.0.3 port =
2703 flags S keep state group 300
pass in quick on ep1 proto tcp from 192.168.0.0/24 to 192.168.0.3 port = 7
flags S keep state group 300
ipnat.rules:
# map razor connections to the mail server
rdr ep0 0.0.0.0/0 port 2703 -> 192.168.0.3 port 2703 tcp
rdr ep0 0.0.0.0/0 port 7 -> 192.168.0.3 port 7 tcp
I've got two nics in the router, ep0 the public nic and ep1 the private one.
I have a kernel compiled with:
options IPFILTER_DEFAULT_BLOCK
which blocks everything unless i explicitly allow it. And then i've got
interfaces specified by group. Group 100 is anything coming from the
internet, for instance an ssh connection, 200 is ep0 outbound and everything
is allowed to go out. Group 300 controls what internal traffic can get to
the net, and 400 is outbound on ep1, everything is allowed out.
For winmx i have three machines that i want to be able to access winmx:
192.168.0.10,11,12. They can contact the winmx server, but the connection
fails during the test, where it tries a connection back, it just hangs,
again ipfilter is blocking it.
ipf.rules:
# allow WinMX
pass in quick on ep1 proto tcp from 192.168.0.0/24 to 192.168.0.2 port =
6699 flags S keep state group 300
pass in quick on ep1 proto udp from 192.168.0.0/24 to 192.168.0.2 port =
6257 keep state group 300
ipnat.rules:
# map razor connections to the mail server
rdr ep0 0.0.0.0/0 port 2703 -> 192.168.0.3 port 2703 tcp
rdr ep0 0.0.0.0/0 port 7 -> 192.168.0.3 port 7 tcp
I'm sure it's a rule issue, if anyone can help i'd appreciate it.
Thanks.
Dave.
