On Jul 18, 2011, at 11:53 AM, David van Rensburg - PC Network wrote:
> Yes sorry - I suppose I was assuming that goes without saying.
Well, you can't design working firewall rulesets with unstated requirements.
> Will open 443 for https and close 80 and do a transparent squid proxy
> which I got to wkr.
You need to permit *both* 80 and 443, either directly or via the Squid proxy.
> I just cant seem to understand in and out.
> Does in mean INTO the BOX or into the specific interface what happens if
> you don¹t specify an interface when u say in or out?
> OR does in mean into the internal network from outside or just into the
> box?
>
> Please just elaborate on that for me ?
In refers to incoming traffic to the box running IPFW (and also NAT'ed traffic
which gets re-written by natd to your internal clients); out refers to traffic
generated from the box (and/or from NAT traffic from internal machines via
natd). If that doesn't make sense, consider using "recv", "xmit", and "via
ifX" instead:
recv | xmit | via {ifX | if* | ipno | any}
Matches packets received, transmitted or going through, respec-
tively, the interface specified by exact name (ifX), by device
name (if*), by IP address, or through some interface.
The via keyword causes the interface to always be checked. If
recv or xmit is used instead of via, then only the receive or
transmit interface (respectively) is checked. By specifying
both, it is possible to match packets based on both receive and
transmit interface, e.g.:
ipfw add deny ip from any to any out recv ed0 xmit ed1
The recv interface can be tested on either incoming or outgoing
packets, while the xmit interface can only be tested on outgoing
packets. So out is required (and in is invalid) whenever xmit is
used.
A packet may not have a receive or transmit interface: packets
originating from the local host have no receive interface, while
packets destined for the local host have no transmit interface.
Regards,
--
-Chuck
_______________________________________________
freebsd-ipfw@freebsd.org mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-ipfw
To unsubscribe, send any mail to "freebsd-ipfw-unsubscr...@freebsd.org"
