Folks;
I'm having a bit of a problem with some ipfwadm rules i have in place at a
client site.
They have a privately numbered lan with 4 machines on static IP addresses.
Those machines are to have access to the local lan ,DNS and two web sites only.
Here is what I have in place now that doesn't seem to work:
echo "Loading Masq Modules"
modprobe ip_masq_ftp
modprobe ip_masq_raudio
modprobe ip_masq_irc
echo "Starting IP Forwarding"
ipfadm -F -p deny
ipfwadm -F -a m -S 192.168.1.0/24 -D 0.0.0.0/0
#
# Here are the rules for blocking access to the front desk machines
# that are on static IP addresses.
#
# The following IP addresses should have restricted access:
# 192.168.1.72
# 192.168.1.73
# 192.168.1.74
# 192.168.1.75
#
# Reject and log static IP machines and block access to anywhere.
ipfwadm -I -a reject -V 192.168.1.1 -S 192.168.1.72/32 -D 0.0.0.0/0 -o
ipfwadm -I -a reject -V 192.168.1.1 -S 192.168.1.73/32 -D 0.0.0.0/0 -o
ipfwadm -I -a reject -V 192.168.1.1 -S 192.168.1.74/32 -D 0.0.0.0/0 -o
ipfwadm -I -a reject -V 192.168.1.1 -S 192.168.1.75/32 -D 0.0.0.0/0 -o
# Allow static IP machines. Going anywhere on the local network is valid.
ipfwadm -I -a accept -V 192.168.1.1 -S 192.168.1.72/32 -D 192.168.1.0/24
ipfwadm -I -a accept -V 192.168.1.1 -S 192.168.1.73/32 -D 192.168.1.0/24
ipfwadm -I -a accept -V 192.168.1.1 -S 192.168.1.74/32 -D 192.168.1.0/24
ipfwadm -I -a accept -V 192.168.1.1 -S 192.168.1.75/32 -D 192.168.1.0/24
# Allow static IP machines. Going to www.crmetroymca.org is valid.
ipfwadm -I -a accept -V 192.168.1.1 -S 192.168.1.72/32 -D 206.26.71.24/32
ipfwadm -I -a accept -V 192.168.1.1 -S 192.168.1.73/32 -D 206.26.71.24/32
ipfwadm -I -a accept -V 192.168.1.1 -S 192.168.1.74/32 -D 206.26.71.24/32
ipfwadm -I -a accept -V 192.168.1.1 -S 192.168.1.75/32 -D 206.26.71.24/32
# Allow static IP machines. Going to www.jointplanning.com is valid.
ipfwadm -I -a accept -V 192.168.1.1 -S 192.168.1.72/32 -D 205.252.23.37/32
ipfwadm -I -a accept -V 192.168.1.1 -S 192.168.1.73/32 -D 205.252.23.37/32
ipfwadm -I -a accept -V 192.168.1.1 -S 192.168.1.74/32 -D 205.252.23.37/32
ipfwadm -I -a accept -V 192.168.1.1 -S 192.168.1.75/32 -D 205.252.23.37/32
# Allow static IP machines. Going to ns1.mwaccess.net is valid.
ipfwadm -I -a accept -V 192.168.1.1 -S 192.168.1.72/32 -D 206.26.71.5/32
ipfwadm -I -a accept -V 192.168.1.1 -S 192.168.1.73/32 -D 206.26.71.5/32
ipfwadm -I -a accept -V 192.168.1.1 -S 192.168.1.74/32 -D 206.26.71.5/32
ipfwadm -I -a accept -V 192.168.1.1 -S 192.168.1.75/32 -D 206.26.71.5/32
# Allow static IP machines. Going to ns2.mwaccess.net is valid.
ipfwadm -I -a accept -V 192.168.1.1 -S 192.168.1.72/32 -D 206.26.71.6/32
ipfwadm -I -a accept -V 192.168.1.1 -S 192.168.1.73/32 -D 206.26.71.6/32
ipfwadm -I -a accept -V 192.168.1.1 -S 192.168.1.74/32 -D 206.26.71.6/32
ipfwadm -I -a accept -V 192.168.1.1 -S 192.168.1.75/32 -D 206.26.71.6/32
What am I doing wrong here?
Is it the order they are in?
Any help would be greatly appreciated.
Thanks
_______________________________________________
Masq maillist - [EMAIL PROTECTED]
http://tiffany.indyramp.com/mailman/listinfo/masq
Admin requests can be handled by web (above) or [EMAIL PROTECTED]
