IPFW.

[Dan]

On Sunday 19 October 2003 4:59 pm, you wrote:
> On Sun, Oct 19, 2003 at 03:32:40PM +0100, Dan wrote:
> > Hi there.
> > I hope you can help.
> > I've been trying and trying for days to try and get these rules sorted,
> > as whenever they're used, my laptop (which is using my FreeBSD box as a
> > gateway) cannot access the Internet.
>
> I suggest you put "log" on all your denies, and by ipfw -atde list
> see which rules are stopping the packets.
>
> Aside from whether the ruleset works, it seems inconsistent.  If you're
> going to keep state, you should not be allowing tcp established, but
> instead setting up state on setup, both ways.  btw, "pass" means allow,
> did you mean "deny"?

Hi there. Thank you very much for your reply.
I couldn't see anything obvious in ipfw -atde list - and I tried requestnig a 
new page from the laptop, but saw nothing new there.

I've taken what you said -- and as far as I can understand (sorry..this is 
really hard to me) I've come up with:

Is this better? thanks again!

# Define the firewall command (as in /etc/rc.firewall) for easy
# reference.  Helps to make it easier to read.
fwcmd="/sbin/ipfw"

# Force a flushing of the current rules before we reload.
$fwcmd -f flush

# Divert all packets through the tunnel interface.
$fwcmd add 50 divert natd all from any to any via sis0

# Allow all connections that have dynamic rules built for them,
# but deny established connections that don't have a dynamic rule.
# See ipfw(8) for details.
$fwcmd add check-state
$fwcmd add pass tcp from any to any keep-state

# Allow all localhost connections
${fwcmd} add 100 pass all from any to any via lo0
${fwcmd} add 200 deny log all from any to 127.0.0.0/8
${fwcmd} add 300 deny log ip from 127.0.0.0/8 to any

# Allow all connections from my network card that I initiate
$fwcmd add allow tcp from me to any out xmit any setup keep-state
$fwcmd add deny log tcp from me to any
$fwcmd add allow ip from me to any out xmit any keep-state
$fwcmd add allow all from 192.168.0.0/24 to any

# Everyone on the Internet is allowed to connect to the following
# services on the machine.  This example specifically allows connections
# to sshd and a webserver.
$fwcmd add allow tcp from any to any keep-state
$fwcmd add allow tcp from any to me 80 setup
$fwcmd add allow tcp from any to me 22 setup

# This sends a RESET to all ident packets.
$fwcmd add reset log tcp from any to me 113 in recv any

# Enable ICMP: remove type 8 if you don't want your host to be pingable
$fwcmd add allow icmp from any to any icmptypes 0,3,8,11,12,13,14

# Deny all the rest.
$fwcmd add deny log ip from any to any