/* HINT: Search archives @ http://www.indyramp.com/masq/ before posting! */
Matthew Ramsay <[EMAIL PROTECTED]> wrote:
>
> Firewall on linux 2.0.38 kernel: 192.168.0.1
> Windows Machine 1 on LAN (192.168.0.2)
> Windows Machine 2 on LAN (192.168.0.3)
> Both windows machine have 192.168.0.1 as their default gateway.
> Firewall connects to Internet via PPP.
>
> 1) No Internet restrictions for both windows machines (ie. they can
> access the web etc.)
>
> ipfadm -F -a masq -S 192.168.0.0/24 -D 0.0.0.0/0
Yes, that would do it.
> 2) Say that I now want to block both windows machines from accessing
> certain parts of the Internet (in particular say email..). So what
> I want to do now is block all requests from our windows machines
> from reaching ports 25 and 110 on the outside world. This will
> still allow the windows guys to say browse the web (port 80).. but
> any attempt to check email on an external server would be denied.
>
> ipfwadm -I -i reject -W ppp0 -P tcp -S 192.168.0.0/0 -D 0/0 25 110
No... First of all, port 25 is used to *send* mail. It isn't used to
poll for mail from another host. The other port you give, 110, is the
POP3 port. But there are other protocols, such as POP2 (port 109), and
IMAP (port 143), which you would have to block, in order to prevent
checking for mail. And there might be other protocols I haven't thought
of.
So, blocking ports 109, 110, and 143 would be more effective than above.
Blocking port 25 only prevents your clients from sending mail.
Now, as to the rest of why this rule won't work... first of all, a
client trying to reach the internet must send a packet to the masq box.
That packet will come in presumably through ethernet (eth0, I assume),
then if it passes the forwarding check, it gets masqueraded, and sent
out the ppp0 interface.
Your rule triggers on incoming packets, yes, but it's looking for the
incoming packet on ppp0. You should instead use -W eth0, because you
want to stop the packet when it comes in over that interface, before it
gets masqueraded. In such a case, you don't need to specify -S with any
specific address, "-S 0/0" would work just fine, because what really
matters is which interface the packet entered by.
> 3) And if I wanted to stop Windows Machine 2 (192.168.0.3) from accessing
> the Internet at all I would type:
>
> ipfwadm -I -a reject -S 192.168.0.3/32 -D -0.0.0.0/0
This would work fine. However, it also prevents the machine from
talking to the masq box itself. If you were running some services on
the masq box (local DNS, SMTP, etc) that you want
_______________________________________________
Masq maillist - [EMAIL PROTECTED]
Admin requests can be handled at http://www.indyramp.com/masq-list/ -- THIS INCLUDES
UNSUBSCRIBING!
or email to [EMAIL PROTECTED]
PLEASE read the HOWTO and search the archives before posting.
You can start your search at http://www.indyramp.com/masq/
Please keep general linux/unix/pc/internet questions off the list.
