faq
search
add article
cool-stuff
how-to
main
tips
parent
thread
|
Re: IPFilter on FreeBSD 4.6-STABLE
by Neafevoc on Thursday August 22, @01:18PM
|
First of all... thanks for the help Erik. It works!
Did my problem lie in my original ipnat.rules? I thought I was supposed to direct it to an actual IP address to my external NIC?
And it didn't matter if my external NIC was /29? (Or subnet mask 255.255.255.248).
I ask this only to understand the workings of IPFilter (and probably networking in general).
Now that it works, I'll write new ipf.rules and ipnat.rules. And I'll follow ipnat.rules where my external NIC is 0/32, correct? (Sorry for being redundant. Hopefully this post will help others out since I couldn't find any other post relating to IPF on this site.)
Thanks again :) |
|
|
The Fine Print: The following comments
are owned by whoever posted them.
( Add a Reply )
|
Re: IPFilter on FreeBSD 4.6-STABLE
by Coercitas on Thursday January 22, @08:23AM
|
Actually, your problem was your ipnat rules. You just asked IPF to map your internal LAN with any possible address in the XXX.224.XXX.XXX/29 subnet, which won't work.
Imagine XXX.224.XXX.XXX/29 stands for 80.224.128.0/29; then ipnat would map your internal LAN with any possible address from 80.224.128.1 to 80.224.128.6 (80.224.128.7 means BROADCAST and thus, cannot be applied). Problem is you only are reachable with one of those addresses (or your ISP gave you this whole pool of addresses and something else have to be done on your IPF box to accept this). Pretty sure the first (or last, depends on your ISP) address in this subnet is ISP's side so this address can't be used (but ipnat may use it since you allowed it to do so) and other addresses have to exist...if you only have one of these (you can set up many addresses on one NIC) configured on your side, no one could reach others (since they don't even exist actually).
The "map fxp0 0/0 -> 0/32" statement means "change
anything that go out on interface fxp0 with my real fxp0's address".
The "map fxp0 10.0.0.0/24 -> 0/32" command means "change anything going out on interface fxp0 with source address in the 10.0.0.0/24 subnet with my real fxp0's address"
So yes, it does matter you are in a 29 bit subnet, you have to really understand how things work with TCP/IP subnetting before going any further or you may shoot yourself in the foot and get some serious headhache.
If you only own a single address in the XXX.224.XXX.XXX/29 subnet, then you must use the "0/32" statement. If you own all this subnet (but the ISP router one) you can use them to set up a DMZ and put there some servers of your choice...or anything else you prefer.
Hope this helped a bit.
|
[
Add a Reply to this ]
|
The Fine Print: The following
comments are owned by whoever posted them.
( Article Reply )
|
|
Related Links 
