🚀 go-pugleaf

Mmmmm... still not clear what I'm doing wrong... sorry...

<shikahr-usenet@[10.0.0.1]> wrote in message
news:shikahr-usenet-997210205@[10.0.0.1]...
> In <GuNb7.123$gX2.27571@afrodite.telenet-ops.be>,
> Ish wrote:
>
>
> > I wrote some firewall-rules under FreeBSD 3.5.1 and most of them are
quite
> > working...
> > Having a little local network (192.xxx.xxx.0), surfing tru my BSD with 2
> > nic's,
> > one connected to The Net (rl1), one to the local net (rl0).
> >
> > LOCALNET ------> rl0 ------> rl1 -------> INTERNET
>
> # make the rules understandable by interface
> # what you want to do differs by where the packet is and where
> # it is going
>
> #  ipfw add 150 count log all from any to any # see whats happening
>
>    ipfw add 200 skipto 1000 all from any to any via rl0
>    ipfw add 300 skipto 2000 all from any to any via rl1
>    ipfw add 400 deny log all from any to any   # just in case
>
> # rules for the localnet
> # no particular rules here in this example
>    ipfw add 1100 allow all from localnet to any in
>    ipfw add 1200 allow all from any to localnet out
>    ipfw add 1300 deny log all from any to any # just in case
>
> # rules for the internet
>    ipfw add 2100 skipto 3000 all from any to any in
>    ipfw add 2200 skipto 4000 all from any to any out
>    ipfw add 2300 deny log all from any to any # just in case
>
> # packets coming in from the internet
>    ipfw add 3100 deny log all from localnet to any # no spoofing
>    ipfw add 3200 deny log all from 127.0.0.0/8 to any # no spoofing
>    ipfw add 3300 skipto 5000 all from any to any
>    ipfw add 3400 deny log all from any to any # just because
>
> # packets going out to the internet
>    ipfw add 4100 skipto 5000 all from localnet to any # natd these
>    ipfw add 4200 allow all from rl1-IP to any # un-natd stuff
>    ipfw add 4300 deny log all from any to any # just because
>
> # nat translation - only 1 divert rule allowed/works (see man page)
> # that why the various skipto rules all converge here
>
>    ipfw add 5100 divert natd all from any to any
>    ipfw add 5200 allow all from rl1-IP to any out
>    ipfw add 5300 allow all from any to localnet in
>
> The setup for natd and ipfw is not the most straightforward thing,
> especially is you have some kind of server on the natd machine
> that is not supposed to be translated. You have to intercept those
> packets and accept them directly, without translatation.
>