🚀 go-pugleaf

In <GuNb7.123$gX2.27571@afrodite.telenet-ops.be>,
Ish wrote:


> I wrote some firewall-rules under FreeBSD 3.5.1 and most of them are quite
> working...
> Having a little local network (192.xxx.xxx.0), surfing tru my BSD with 2
> nic's,
> one connected to The Net (rl1), one to the local net (rl0).
> 
> LOCALNET ------> rl0 ------> rl1 -------> INTERNET

I do something like this, making a lot of trial-and-error use of
the "ipfw count log" as a debug trace statement to see what's going
where when to what. From my experience, this is the kind of setup
strategy that seems to work. Use the "count log" in places to
see what's happening.

firewall rules:

# get this out of the way first

   ipfw add 100 allow all from any to any via lo0

# make the rules understandable by interface
# what you want to do differs by where the packet is and where
# it is going

#  ipfw add 150 count log all from any to any # see whats happening

   ipfw add 200 skipto 1000 all from any to any via rl0
   ipfw add 300 skipto 2000 all from any to any via rl1
   ipfw add 400 deny log all from any to any   # just in case

# rules for the localnet
# no particular rules here in this example
   ipfw add 1100 allow all from localnet to any in
   ipfw add 1200 allow all from any to localnet out
   ipfw add 1300 deny log all from any to any # just in case

# rules for the internet
   ipfw add 2100 skipto 3000 all from any to any in
   ipfw add 2200 skipto 4000 all from any to any out
   ipfw add 2300 deny log all from any to any # just in case

# packets coming in from the internet
   ipfw add 3100 deny log all from localnet to any # no spoofing
   ipfw add 3200 deny log all from 127.0.0.0/8 to any # no spoofing
   ipfw add 3300 skipto 5000 all from any to any
   ipfw add 3400 deny log all from any to any # just because

# packets going out to the internet
   ipfw add 4100 skipto 5000 all from localnet to any # natd these
   ipfw add 4200 allow all from rl1-IP to any # un-natd stuff
   ipfw add 4300 deny log all from any to any # just because

# nat translation - only 1 divert rule allowed/works (see man page)
# that why the various skipto rules all converge here

   ipfw add 5100 divert natd all from any to any
   ipfw add 5200 allow all from rl1-IP to any out
   ipfw add 5300 allow all from any to localnet in

The setup for natd and ipfw is not the most straightforward thing,
especially is you have some kind of server on the natd machine
that is not supposed to be translated. You have to intercept those
packets and accept them directly, without translatation. 

-- 
Randall Raemon
posting.shikahrsoho.com, email to "rlr+usenet"