ipfw problem

[Lowell Gilbert]

Rapier <bsdwave at go.ro> writes:

> Hello everyone,
> 	I have a small home network with 3 boxes behind a FreeBSD 4.7-RELEASE(natd).I had to allow outbound tcp 5200 from 192.168.0.3,and 5198,5199 udp outbound and inbound from the same box,did that with natd -redirect-port.Everything was fine when i had ipfw add allow ip from any to any.I put up a small firewall and cannot seem to figure it out why it ain't working(redirecting those 2 udp's).Nothing shows up denied in the firewall's log.The accounting to those 2 udp's remain 0.Something is messed in my firewall rulles,i need a little help please.Here is my firewall:

I would guess that your keep-state rules aren't doing what you
expect.  ipfw's state-keeping doesn't mix well with NAT.  In this
case, I think what's happening is that the incoming interface
information has already been lost (by the pass through natd) before
the state is checked.

> ################################################################
> 00100   436    20928 allow tcp from any to any 5200 via any
> 00110     0        0 allow udp from any to any 5198 via any
> 00120     0        0 allow udp from any to any 5199 via any
> 01000     0        0 deny log logamount 100 ip from 10.0.0.0/8 to any in recv rl0
> 01100     0        0 deny log logamount 100 ip from 172.16.0.0/12 to any in recv rl0
> 02000     6      240 allow ip from any to any via lo0
> 02100     0        0 deny log logamount 100 tcp from any to any in tcpflags fin,syn
> 02150     0        0 deny log logamount 100 ip from any to any in recv any frag
> 02200     3      132 reset tcp from any to any 113
> 02300  6452  5118652 divert 8668 ip from any to any via rl0
> 03000     0        0 allow icmp from any to any icmptype 3
> 03100     0        0 allow icmp from any to any icmptype 4
> 03200     0        0 allow icmp from any to any out icmptype 8
> 03300     0        0 allow icmp from any to any in icmptype 0
> 03400     0        0 allow icmp from any to any in icmptype 11
> 04000     0        0 check-state
> 04200    81     8934 deny log logamount 100 tcp from any to any in established
> 04300    67    11835 allow udp from 192.168.0.0/24 to any keep-state via rl1
> 04400 12506 10342918 allow tcp from 192.168.0.0/24 to any keep-state via rl1 setup
> 04500    30     2396 allow udp from 81.196.89.85 to any keep-state via rl0
> 04600  2818   117654 allow tcp from 81.196.89.85 to any keep-state via rl0
> 65000    26     1872 deny log logamount 1000 ip from any to any
> 65535     0        0 deny ip from any to any
> 
> ################################################################
> ---------------------------------------------------
> "Definitions of hardware and software for dummies:
> 
>         Hardware is what you kick;
>         Software is what you curse."
> 
> _______________________________________________
> freebsd-questions at freebsd.org mailing list
> http://lists.freebsd.org/mailman/listinfo/freebsd-questions
> To unsubscribe, send any mail to "freebsd-questions-unsubscribe at freebsd.org"