Controlling WAN access using natd/ipfw

[Frank Leonhardt]

Okay - it wasn't as simple as adding a rule before the natd one, and now 
I really am stuck!


On 18/03/2014 08:56, Frank Leonhardt wrote:
> No one? I'll drive there later today and try the options safely.
>
> Regards, Frank.
>
>
> On 17/03/2014 13:35, Frank Leonhardt wrote:
>> I can see a few strategies for doing this, but as I'm about to change 
>> a firewall remotely I'd rather have a definitive working example for 
>> obvious reasons... :-)
>>
>> The setup is simple. natd and ipfw are currently sharing a public /29 
>> with a private /24. Everything on the LAN can currently do anything 
>> likes through the gateway.
>>
>> I want to stop anything on the LAN between 192.168.1.50 and 
>> 192.168.1.100 (for example) from getting through the gateway (they 
>> can use the proxy). Everything else should be business as usual.
>>
>> Current ipfw script is:
>>
>> /sbin/ipfw add divert natd all from any to any via rl0
>> /sbin/ipfw add pass all from any to any
>>
>> Which, as a sanity check, leads to:
>>
>> 00100 divert 8668 ip from any to any via rl0
>> 00200 allow ip from any to any
>> 65535  deny ip from any to any
>>
>> I'm having a brain storm here. Should rule 50 be "deny ip from 
>> 192.168.1.50-192.168.1.100 to any"
>>
>> I don't even know if it'll buy that kind of IP address list (I 
>> suspect not). I know it does CIDR but the range doesn't suit, or a 
>> table (which I've never used before, but if I've got the syntax I 
>> might just as well add multiple rules as table entries in this case). 
>> And I'm completely not sure about what natd does to all of this - 
>> never been there before.
>>
>> So - can anyone tell me EXACTLY the line I need? It's four hours of 
>> driving if I get it wrong...
>>
>> As a supplementary questions, presumably I can add a port number 
>> after the source specification to block individual ports?
>>
>> Thanks, Frank.
>>
>
> _______________________________________________
> freebsd-questions at freebsd.org mailing list
> http://lists.freebsd.org/mailman/listinfo/freebsd-questions
> To unsubscribe, send any mail to 
> "freebsd-questions-unsubscribe at freebsd.org"