For instance : If I want to deny 128.0.100.15 the ability to masquerade for
browsing the web etc and let the rest of the Class A, 128.0.100/16 allowed
to, If I do something like :
ipfwadm -F -p d
ipfwadm -F -a deny -W eth1 -S128.0.100.0/16 -D 0.0.0.0/0
ipfwadm -F -a masq -W eth1 -S128.0.100.0/16 -D 0.0.0.0/0
Rule one is ignored and everyone is allowed to browse, maybe I need a head
check.
Cheers,
Stephen.
> Port forwarding? As a technique to deny traffic? I must be dense, I
> don't get it. ipfwadm filtering should be the right answer.
>
> You weren't too specific about what you tried that didn't work. If
> it was a Forward or Output rule, it won't work because masquerading
> has already taken place. It should be a pair of Input rules on the
> local interface: the first accepting traffic from the restricted IP
> to the local net, and the second denying all other packets from the
> restricted IP.
>
> Is that what you tried?
>
> | --Stephen
> |
> | ----- Original Message -----
> | From: Mich <[EMAIL PROTECTED]>
> | To: Stephen Mills <[EMAIL PROTECTED]>
> | Sent: Thursday, May 20, 1999 9:41 AM
> | Subject: Re: [Masq] exception to the rule
> |
> |
> | > Stephen,
> | >
> | > have you tried to just port forward that connection to another port it
may
> | > be a work around
> | >
> | > Mich
> | >
> | > ----- Original Message -----
> | > From: Stephen Mills <[EMAIL PROTECTED]>
> | > To: <[EMAIL PROTECTED]>
> | > Sent: Wednesday, May 19, 1999 7:13 PM
> | > Subject: [Masq] exception to the rule
> |...
> | > > Simply, I would like one workstation *not* to be able to browse the
web,
> | > and
> | > > the rest of the Class A network to be able to.
>
> Do you want the restricted machine to have *no* external access, or
> just restrict HTTP? For just HTTP, you'd want to add
> "-D 0.0.0.0/0 80" to the deny rule.
>
> | > > If I put the deny rule stating that this IP address isnt allowed the
> | > browse
> | > > etc, and the rest of the Class A is, rule one gets ignored, and all
> | > > workstations are allowed to browse.
>
> What rule, specifically?
>
> HTH...
>
> - Fred Viles <mailto:[EMAIL PROTECTED]>
>
>
>
>
> _______________________________________________
> Masq maillist - [EMAIL PROTECTED]
> http://tiffany.indyramp.com/mailman/listinfo/masq
> Admin requests can be handled by web (above) or
[EMAIL PROTECTED]
_______________________________________________
Masq maillist - [EMAIL PROTECTED]
http://tiffany.indyramp.com/mailman/listinfo/masq
Admin requests can be handled by web (above) or [EMAIL PROTECTED]
