Re: ipfw with NAT and ARP
From: Charles Swiger (cswiger_at_mac.com)
Date: 04/29/04
- Previous message: clayton rollins: "from newbies: bzflag under FreeBSD release 5.2.1 - can't open display - missing"
- In reply to: Andrea E.: "ipfw with NAT and ARP"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]
Date: Thu, 29 Apr 2004 16:44:04 -0400 To: "Andrea E." <andrea@ae4u.de>
On Apr 29, 2004, at 5:30 PM, Andrea E. wrote:
[ ... ]
> But, I wont so a simple firewall and for this reason, first I want to
> configure the ICMP-protocol:
>
> ip_ext => External IP-Address
>
> ipfw -f flush
> ipfw add divert natd all from any to any via xl1
> ipfw add allow icmp from $ip_ext to any icmptypes 8 out via xl1
> ipfw add allow icmp from any to $ip_ext icmptypes 0 in via xl1
>
> -> It's not ok. With "ethereal" no pakets are going out (test from an
> other system, connected with a HUP.)
Add a "ipfw add deny log ip from any to any" and you will be able to
troubleshoot your own problems much more effectively by checking the
logging.
Most probably, you'll need to take into account that the IP addresses
of packets get re-written after being diverted to natd.
> When testing "ping" from external to external IP-Adress of my
> firewall, the ARP-request: to broadcast Who has xxx.xxx.xxx.xxx? Tell
> xxx.xxx.xxx.xxx fails
>
> -> seems to have a problem to let ARP through the firewall.
>
> Above -> "ipfw add allow all from any to any" let ARP through the
> firewall. So I think, thats the configuration of the rest of my
> computer (like kernel, rc.conf, etc. ist ok)
ARP traffic is subnet-local and is not passed through a routing device,
such as the NAT'ing firewall you are testing. If you want to pass
ARPs, consider using layer-2 bridging instead of layer-3 routing and
address translation.
> There is a bug:
> After restarting system with above configuration of icmp-protocol no
> ping-request is going out. After a flush of all rules and configuring
> of "ipfw add allow all from any to any" ping-request get an answer.
No bug. There are kernel options which control whether IPFW is
configured to pass or deny traffic by default. Consider adding:
options IPFIREWALL_DEFAULT_TO_ACCEPT
...to your kernel config and rebuilding the kernel.
-- -Chuck PS: Cross-posting to multiple groups is better than posting a single message twice, and posting just to -questions is usually enough... _______________________________________________ freebsd-questions@freebsd.org mailing list http://lists.freebsd.org/mailman/listinfo/freebsd-questions To unsubscribe, send any mail to "freebsd-questions-unsubscribe@freebsd.org"
- Previous message: clayton rollins: "from newbies: bzflag under FreeBSD release 5.2.1 - can't open display - missing"
- In reply to: Andrea E.: "ipfw with NAT and ARP"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]
Relevant Pages
|
