[EMAIL PROTECTED] <[EMAIL PROTECTED]> wrote:
>
> > The -W option means something different on input rules vs. forward
> > rules.
>
> Maybe I misunderstood you. On the input rule, doesn't -W refer to the the
> interface where the traffic is coming into
Yes, that's right. For an INPUT rule, that's what -W means.
> For example: "ipfwadm -I -a deny -W eth1 -S any/0"
> Isn't this saying "deny all traffic entering eth1?"
Yes. In fact, you don't even have to supply the -S option, since it's
not limiting anything.
> For the forward rule, what does something like this, "ipfwadm -F -a
> accept -W eth1 -S any/0 -D 192.168.1.2" mean?
It means to accept any traffic in which the destination IP is
192.168.1.2, and the ethernet it is about to be forwarded TO is eth1.
You see, the input and output rules only have one interface that they
need to be referring to. The interface that the traffic is coming in on
(for input rules) or going out to (for output rules). But forwarding
rules can, potentially, in the minds of firewall creators, refer to
either of the two interfaces, the one that let the traffic in, or the
one that's going to send the traffic back out.
But, the kernel only cares about what it's job is. It doesn't care
where the traffic came from. All the kernel knows is, the packet needs
to be forwarded, and after consulting the route table, the kernel has
chosen that it's going to go out some interface (interface eth1,
perhaps). So then the kernel will consult the forwarding ruleset, with
the information about the packet, and the interface chosen to forward
to. The rules can then either accept or deny the packet accordingly.
So just be sure you're thinking of where traffic is going to be routed
TO, when constructing your forwarding rules.
--
[EMAIL PROTECTED] (Fuzzy Fox) || "Nothing takes the taste out of peanut
sometimes known as David DeSimone || butter quite like unrequited love."
http://www.dallas.net/~fox/ || -- Charlie Brown
_______________________________________________
Masq maillist - [EMAIL PROTECTED]
http://tiffany.indyramp.com/mailman/listinfo/masq
Admin requests can be handled by web (above) or [EMAIL PROTECTED]
