bridge and firewall

[Crist J. Clark]

On Thu, May 08, 2003 at 12:39:11PM +0200, xskoba1 at kremilek.gyrec.cz wrote:
> Can anyone help with this. Bridge is enabled, even in sysctl. Firewall is
> enabled and configured. But my reality is done this way..
> 
> 
> Cisco
> (NATing
>  192.168.1.0/24) ---- Freebsd Bridge (Public IP) ------ stations
> (Public IP)            (NATing 172.16.0.0/24            192.168.1.xx
>                          or something similar)          172.16.0.xx and on
>                          one public IP one private       witch even one
>                                                            public IP...
> 
> ok... it looks horribly, but I am not having time to change it... we are
> going to change IPS and so on...
> 
> so... what are the rules which should be added
> 
> users are permited to connect inside.... to public IP trough SSH
> named is on FreeBSD and used by inner adress (192... 172...)
> 
> and firewall than behaves strangely...
> 
> thanks for any idea, unless you want me to reconfigure it at all... it is
> a school and I am not having time until holiday

Bridged packets only go through firewall processing on input. If you
have a,

  divert natd ip from any to any via if0

(Where if0 is the external interface) it will not work since packets
going out the interface never hit that rule.
-- 
Crist J. Clark                     |     cjclark at alum.mit.edu
                                   |     cjclark at jhu.edu
http://people.freebsd.org/~cjc/    |     cjc at freebsd.org