> Hello,
>
> Some time a go I posted the same question to freebsd-questions, but uptill now
> I didn't get an answer.
>
> Currently I'm trying to move towards a statefull packet filter. When testing
> without nat all seems to work fine. But when I added natd (as the first
> rule) packets that were natd-ed on their way out had their return traffic
> blocked. The question is, what am I doing wrong?!?
nat changes addresses and then reinjects packets in the firewall.
Chances are that there is no dynamic rule matching the
packet after the translation.
cheers
luigi
> I hope somebody can tell me how to solve this problem.
>
> Rene
>
> from my logs:
>
> ipfw: Accept TCP 212.238.x.x:1026 x.x.x.x:23 out via isp0
> ipfw: Deny TCP x.x.x.x:23 192.168.1.3:1026 in via isp0
>
> ipfw rules:
>
> /sbin/ipfw -f flush
>
> /sbin/ipfw -q add divert natd all from any to any via isp0
>
> /sbin/ipfw -q add allow all from any to any via lo0
> /sbin/ipfw -q add allow all from any to any via dc0
>
> /sbin/ipfw -q add check-state from any to any via isp0
> /sbin/ipfw -q add deny log tcp from any to any established
> /sbin/ipfw -q add allow all from any to any out via isp0 keep-state
>
> /sbin/ipfw -q add deny log all from any to any
>
> --
> Rene de Vries http://www.tcja.nl mailto:[EMAIL PROTECTED]
>
>
> To Unsubscribe: send mail to [EMAIL PROTECTED]
> with "unsubscribe freebsd-hackers" in the body of the message
>
To Unsubscribe: send mail to [EMAIL PROTECTED]
with "unsubscribe freebsd-hackers" in the body of the message
