Firewalls in FreeBSD?
Jeremy Chadwick
koitsu at FreeBSD.org
Fri Oct 31 09:10:14 PDT 2008
On Fri, Oct 31, 2008 at 12:05:28PM -0400, Lowell Gilbert wrote:
> Jeremy Chadwick <koitsu at FreeBSD.org> writes:
>
> > On Thu, Oct 30, 2008 at 06:34:31PM -0500, Jack Barnett wrote:
> >>
> >> Ok, I had some progress with this last night. Basically what I do is:
> >>
> >> in natd - redirect_port 1000 to 10000 to the internal windows box.
> >> set ipfw to "open" file wall.
> >>
> >> Obviously this isn't prefect - but gives some idea of what's going on.
> >>
> >> What I'd like to do, is a) keep the nat redirects since that works
> >> pretty well.
> >> b) in ipfw, ONLY allow data back on these ports IF the windows box has
> >> established the connection out first then deny everything else.
> >
> > This is called "port triggering" in the residential router world. I
> > don't know how to do this on FreeBSD.
>
> Stateful rules are the only way to do it.
> In fact, this is the main purpose of stateful rules.
Read this part of the thread, where I outline protocol flow (based on
what the OP has stated about the protocol, which so far appears to be
accurate):
http://lists.freebsd.org/pipermail/freebsd-questions/2008-October/thread.html
Stateful rules will not solve this problem.
The OP wants a feature that tells ipfw or pf "after the TCP handshake
has completed, dynamically add a port forward for port X on interface Y
to machine A on port Z; when the TCP session is FIN'd cleanly, or
extinguishes, dynamically remove that port forward".
--
| Jeremy Chadwick jdc at parodius.com |
| Parodius Networking http://www.parodius.com/ |
| UNIX Systems Administrator Mountain View, CA, USA |
| Making life hard for others since 1977. PGP: 4BD6C0CB |
More information about the freebsd-questions
mailing list