[snip]
> Ok, I jumped earlier, but actually re-RTF ruleset, I've got a couple
> questions:
>
> - Is it only one pc that can't get through?
> - Do other services work from behind NAT? (http etc)
>
> It looks like rule 4109 should be BEFORE 4090, as 4090 denies all traffic
> and stops, and internal traffic can't go anywhere (or so it appears).
>
> Steve
>
[snip]
steve,
Yes everything else seems to work fine. There are currently 2 PCs
with this issue. 1 is XP the other is Win2k. This ruleset worked
fine on FreeBSD 5.1, but I reformatted the box, and install 5.2.1
uploaded the rc.firewall.rules and natd.conf files, since the network
interfaces where the same I didn't really have to change anything.
I found these rules on this website:
http://www.lugbe.ch/lostfound/contrib/freebsd_router/
here is the sample I used from the website:
# be quiet and flush all rules on start
-q flush
# allow local traffic, deny RFC 1918 addresses on the outside
add 00100 allow ip from any to any via lo0
add 00110 deny ip from any to 127.0.0.0/8
add 00120 deny ip from any to any not verrevpath in
add 00301 deny ip from 10.0.0.0/8 to any in via ep0
add 00302 deny ip from 172.16.0.0/12 to any in via ep0
add 00303 deny ip from 192.168.0.0/16 to any in via ep0
# check if incoming packets belong to a natted session, allow through
if yes
add 01000 divert natd ip from any to me in via ep0
add 01001 check-state
# allow some traffic from the local net to the router
# SSH
add 04000 allow tcp from 192.168.1.0/24 to me dst-port 22 in via ep1
setup keep-state
# ICMP
add 04001 allow icmp from 192.168.1.0/24 to me in via ep1
# NTP
add 04002 allow tcp from 192.168.1.0/24 to me dst-port 123 in via ep1
setup keep-state
add 04003 allow udp from 192.168.1.0/24 to me dst-port 123 in via ep1
keep-state
# DNS
add 04006 allow udp from 192.168.1.0/24 to me dst-port 53 in via ep1
# drop everything else
add 04009 deny ip from 192.168.1.0/24 to me
# pass outgoing packets (to be natted) on to a special NAT rule
add 04109 skipto 61000 ip from 192.168.1.0/24 to any in via ep1
keep-state
# allow all outgoing traffic from the router (maybe you should be more
restrictive)
add 05010 allow ip from me to any out keep-state
# drop everything that has come so far. This means it doesn't belong
to an
established connection, don't log the most noisy scans.
add 59998 deny icmp from any to me
add 59999 deny ip from any to me dst-port 135,137-139,445,4665
add 60000 deny log tcp from any to any established
add 60000 deny log ip from any to any
# this is the NAT rule. Only outgoing packets from the local net will
come here.
# First, nat them, then pass them on (again, you may choose to be more
restrictive)
add 61000 divert natd ip from 192.168.1.0/24 to any out via ep0
add 61001 allow ip from any to any