Re: FreeBSD 6.1 and 6.2 i386 firewall or NAT block web mail applications

Yes. You may be right. But I fixed it the other way. I did not
understand it. I just changed
${fwcmd} add fwd 127.0.0.1,8843 tcp from any to any 443 in keep-state
to
${fwcmd} add fwd 127.0.0.1,8843 tcp from any to any 443 in via tun0 keep-state
Now everything is working. I am using pppoe. tun0 is another interface
dealing with ppp. In local network, we have to use https://ip:8843,
but from outsided, poeple can use https://ip to get my web server with
SSL.
By the way, I used FIREWALL_DEFAULT_TO_ACCEPT and recompile the kernel.
Tell you another trick: the GENERIC kernel is working for pppoe. But
when you recompile with firewall, it won't work for pppoe any more.
You have to add options NETGRAPH, options NETGRAPH_PPPOE and
NETGRAPH_SOCKET.
Besides, you cannot delete device keyboard. If you delete device
keyboard, you won't type anything when it prompt login:

On 11/28/06, Julian Elischer <julian@xxxxxxxxxxxx> wrote:
fulan Peng wrote:
> Hi,
> I need some help with FreeBSD firewall with NAT. I have made pppoe and
> NAT working with both 6.1 release and 6.2 RC i386. All I want is to
> forward port 443 to port 8843. I added a line in the OPEN portion in
> the rc.firewall file:
> ${fwcmd} add fwd 127.0.0.1,8843 tcp from any to any 443 in keep-state


how about:
${fwcmd} add fwd 127.0.0.1,8843 tcp from any to me 443 in keep-state

(or specify the actual address you want to forward)

> Now, when I type https://myserver's ip, it will forward to a proxy
> server listening at 8843. This is good. But, in the local network,
> nobody can access the yahoo and google mail.
> I made another kernel with the options IPFIREWALL_DEFAULT_TO_ACCEPT.
> When I ipfw, there is only one rule:
> allow ip from any to any
> This is good.
> When I added a line
> ipfw add fwd 127.0.0.1,8843 from any to any 443 in keep-state
> again, it won't work with any web email applications.
> I added a line like this
> ${fwcmd} add pass tcp from any to any 25 setup
> Still it won't work.
> pen at both 6.1 and 6.2 are not working. I remember it works only with
> 7.0-current.
> I have only 3 options when I compile the kernel:
> options IPFIREWALL
> options IPFIREWALL_FORWARD
> options IPDIVERT
>
> in order to get pppoe to work, I added
> options NETGRAPH
> options NETGRAPH_PPPOE
> options NETGRAPH_SOCKET
>
> my rc.conf is like this
> gateway_enable="YES"
> hostname=...
> ifconfig_ed0=...
> ppp_enable="YES"
> ppp_nat="YES"
> ppp_profile="sympatico"
> ppp_mode="ddial"
> firewall_enable="YES"
> firewall_type="OPEN"
>
> By the way, I have made this mistake twice:
> Comment out firewall_enable and firewall_type, the default rule is to
> lock out any body. I could not access my remote server. I wish you
> would not do this like me.
> The best way is to have an options IPFIREWALL_DEFAULT_TO_ACCEPT. The
> problem is : whenever you add some rule, it will block web mails!
> _______________________________________________
> freebsd-current@xxxxxxxxxxx mailing list
> http://lists.freebsd.org/mailman/listinfo/freebsd-current
> To unsubscribe, send any mail to "freebsd-current-unsubscribe@xxxxxxxxxxx"


_______________________________________________
freebsd-current@xxxxxxxxxxx mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-current
To unsubscribe, send any mail to "freebsd-current-unsubscribe@xxxxxxxxxxx"

Relevant Pages

  • Re: Problem with firewall
    ... redirect_port tcp 192.168.0.3:2090 2090 ... ${fwcmd} add 100 pass all from any to any via lo0 ... # the "dynamic" rules table by an allow keep-state statement. ... $add pass tcp from any to any 1-65535 out via ${oif} setup ...
    (freebsd-net)
  • Re: natd port redirect
    ... ${fwcmd} add 100 pass all from any to any via lo0 ... $add divert natd all from any to any via ${oif} ... $add divert natd tcp from any to me 23 in via $ ... $add pass tcp from any to any 80 out via $setup keep-state ...
    (comp.unix.bsd.freebsd.misc)
  • Re: ipfw and ssh
    ... ${fwcmd} add pass all from $to $:$ ... This allows any existing TCP connections to work. ... This way you only need one rule (setup) for each inbound service you want. ... This will allow anyone access to my system through SSH provided they can authenticate. ...
    (freebsd-questions)
  • Slow SSH authentication with ipfw
    ... # Allow TCP through if setup succeeded ... ${fwcmd} add pass tcp from any to any established ... $add pass tcp from any to ${internalip} 22 keep-state ...
    (freebsd-questions)
  • Slow NAT firewall
    ... # Allow TCP through if setup succeeded ... ${fwcmd} add pass tcp from any to any established ... $add pass tcp from any to ${internalip} 22 keep-state ...
    (freebsd-questions)