ipfw rules help.

Marwan Sultan Admin at kifco.net
Wed Feb 4 04:41:20 PST 2004

Hello everyone.

    Im on FreeBSD 4.8R, NATd, ipfw enabled, everything working fine.
    my box is behind a DSL modem router and clients behind the FreeBSD.
    My LAN is C class IPs.

    I compiled ipfw to accept by default.
    This is my ipfw list:

00050 divert 8668 ip from any to any via rl0
00100 allow ip from any to any via lo0
00200 deny ip from any to
00300 deny ip from to any
65000 allow ip from any to any
65535 allow ip from any to any

My Questions:

a)   lets say I want to deny everything except a range of IPs
     starting from to
     what rule set should be? how to set range of IPs? to pass
     and deny rest of the C class. FreeBSD Doc's doesnot cover this?
     or i didnot see.!

b)   If i want to deny everything except ip as follow
     00400 allow all from to any
     01000 deny all from any to any.

     when ipfw reads the rules and pass by 00400 then comes to 01000
     then it denies even the, althou i put this rule before the 
     deny ? what im missing? how should i pass 1 ip and deny all?

c)   If I want rule 00400 to expire in 9PM and be active in 8AM.(EXAMPLE)
     how do we do that? is it by set a cron job to delete and add
     the ipfw rule? or there is something to do from the ipfw it self?

D)   Last Q: IF I restart the box all the rules will be reset,
             and comes to default. which is reasonable.
             How to keep it everytime I restart?
             do i create a file somewhere, and i tell my rc.conf for it?
             what the rc.conf line should be? and file format?

    Question out of subject, 
    How i can do something thro cronjob to make the box Email me the
    log of firewall everyday on certain time, lets say 9PM ?

    I hope this questions will help many others, as it will help me.
    And Thank you very much for this list and help.

Marwan Sultan

More information about the freebsd-questions mailing list