Re: firewall with ipfw and natd

Article View: be.comp.security

Article #1756

#1756

From: Magnus
Date: Tue, 07 Aug 2001 10:20

43 lines
2432 bytes

> BUT:
>
>     ipfw add allow tcp from any to any 25
>     ipfw add allow tcp from any to any 110
>
> Where in fact I would like to specify that only the local network can
> send/get mail...
> Supposing I could do it this way:
>
>     ipfw add allow tcp from 192.x.x.0/24 to any 25
>     ipfw add allow tcp from 192.x.x.0/24 to any 110
>

You have of course not used x's in the actual script, didnt know that works
if you did...

You could try..

ipfw add allow tcp from "InternalLAN":255.255.255.0 to any 110,25 via rl0
setup


> ----- less important (?) --------
> What exactly is the use of the loopbackdevice?
> What rules should I add for it?
>     ipfw add allow from any to any via lo0

You need it, rule looks fine.

Either way, you should consider to rewrite your ruleset, and using variables
instead of fixed numbers. here is an example.

fwcmd="/sbin/ipfw"

iif="rl0"                           # internal interface
inet="192.168.0.1"            # internal net
imask="255.255.255.0"    # internal netmask

you then just have to specify wich interface to use, later in the script,
like this.

{fwcmd} add allow tcp from {iif}:{imask} to any via {iif}

Technical Details

Message-ID: <khPb7.995$5R2.102860@news01.chello.no>

Path:

arc1-ca.pugleaf.net!archiver1.google.com!newsfeed.google.com!newsfeed.stanford.edu!newsfeeds.belnet.be!news.belnet.be!newsgate.cistron.nl!amsnews01.chello.com!news01.chello.no!not-for-mail

References: <GuNb7.123$gX2.27571@afrodite.telenet-ops.be>

Show Full Headers

Complete Article Headers

X-Google-Language: ENGLISH,ASCII-7-bit
X-Google-Thread: f922c,27de0af21f29d3af
X-Google-Attributes: gidf922c,public
X-Google-Thread: 113446,27de0af21f29d3af
X-Google-Attributes: gid113446,public
X-Google-Thread: 10eb3b,27de0af21f29d3af
X-Google-Attributes: gid10eb3b,public
X-Google-ArrivalTime: 2001-08-07 03:25:54 PST
Path: arc1-ca.pugleaf.net!archiver1.google.com!newsfeed.google.com!newsfeed.stanford.edu!newsfeeds.belnet.be!news.belnet.be!newsgate.cistron.nl!amsnews01.chello.com!news01.chello.no!not-for-mail
From: "Magnus" <handaa@chello.no>
Newsgroups: be.comp.security,comp.security.firewalls,comp.unix.bsd.freebsd.misc
References: <GuNb7.123$gX2.27571@afrodite.telenet-ops.be>
Subject: Re: firewall with ipfw and natd
Lines: 46
X-Priority: 3
X-MSMail-Priority: Normal
X-Newsreader: Microsoft Outlook Express 6.00.2462.0000
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2462.0000
Message-ID: <khPb7.995$5R2.102860@news01.chello.no>
Date: Tue, 07 Aug 2001 10:20:00 GMT
NNTP-Posting-Host: 62.179.146.41
X-Complaints-To: abuse@chello.no
X-Trace: news01.chello.no 997179600 62.179.146.41 (Tue, 07 Aug 2001 12:20:00 MET DST)
NNTP-Posting-Date: Tue, 07 Aug 2001 12:20:00 MET DST
Organization: chello broadband Norway

Reply to Parent Message