Re: ipfw with four interfaces

[Arvinn Lokkebakken]

Try having the very first rule divert ip from any to any to natd Then, 
you
can configure NATD to only effect RFC1918 packets by adding a -u to the
command line. NAT will take the packet, process it if it's an RFC 1918
address, if not, allow it to pass and then reinject it into the 
firewall at
rule 2 (or next available rule) and continue processing the ruleset.

Like I described I allready use this flag. The problem with having 
divert at the top is that I get thrown off my ssh connection every time 
when I try to reload natd or ipfw. Does it matter if I allow ssh from my 
network before I divert packets to natd?

I've not been awake for long and have had little to no Mt Dew yet so 
don't
hold this against me. Without going over this for awhile, which I 
recommend
when doing a firewall, this may be something in the neighborhood that 
you're
looking for.

In your /usr/local/etc/natd.sh

#!/bin/sh
natd -interface xl2  -s -m -u
Or if you start it from rc.conf:

natd_flags="-s -m -u "
 

I use a natd config file with all these flags so that is taken care of.

The -s tells it to use sockets so that FTP doesn't get broken. You may 
not
need this.
The -m tells natd to attempt to use the same socket as the originating 
host.
The -u tells natd to only translate RFC 1918 packets.

In your firewall rules file:

###############
# more fwrules
fwcmd="/sbin/ipfw"
extif="xl2"
dmzif="fxp0"
lanif="xl0"
motorif="xl1"
#
#
$fwcmd -f flush
#
#
#NATD Divert
$fwcmd add 1 divert natd all from any to any via xl2
#
#You want blocked outbound ports to match early on in the firewall.
#
# Blocking ports out to Internet that I don't like:
$fwcmd add 100 deny tcp from any to any 135-139 out via $extif
$fwcmd add 100 deny tcp from any to any 445 out via $extif
#
#Then your allows:
#
#Network Allows
$fwcmd add 300 allow ip from any to any via $extif
$fwcmd add 300 allow ip from any to any via $dmxif
$fwcmd add 300 allow ip from any to any via $lanif
$fwcmd add 300 allow ip from any to any via $motorif
 

Hm.. You really mean I should add that first allow line there? This four 
rules together is basically the same as ipfw add allow ip from any to 
any isn't it?

# Allow http to the whole dmz from Internet:
$fwcmd add 400 allow tcp from any to w.x.y.80/28 http via $extif
#
# Allow smtp and pop3 to the mailserver from Internet:
$fwcmd add 500 allow tcp from any to w.x.y.84 smtp,pop3 via $extif
 

Aren't these two rules overlapping the first 300 rule?

#Lastly, your denies
#
#Network Denies
#
# Default Block
$fwcmd add 65000 deny ip from any to any
Hope this helps you out.

 

Haven't been able to try them out yet, but I don't feel allowing  The 
first 300 rule will probably help me having the firewall allowing 
traffic for me, but I wasn't really planning to allow everything in. And 
will deny rules have effect  when the traffic allready is allowed?

Arvinn

_______________________________________________
[EMAIL PROTECTED] mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-questions
To unsubscribe, send any mail to "[EMAIL PROTECTED]"