ipf firewall questions

[Aaron Nichols]

On Mon, 15 Nov 2004 15:21:47 -0500, Andrew Smith <andsmith at andsmith.com> wrote:
> I'm using ipf as my firewall, and I can't figure out why OWA is being blocked going to 172.20.0.11.  Below is the current config file which works.  But if I removed the fourth line, my users can't access OWA externally.  I would have thought the lines: pass out quick from 172.20.0.0/24 to any keep state and pass in quick from any to 172.20.0.0/24 would have superceded the line block out log proto tcp from any to any port = 80.
> 
> Any suggestions would be helpful.
> 
> Andrew
> 
> --------------------------------------------------------------------
> 
> #
> # Permit Outlook Web Access
> #
> pass in quick proto tcp from any to 172.20.0.11 port = 80 keep state
> 
> #
> # Allow All College Traffic
> #
> pass in quick from 10.0.0.0/8 to any
> pass out quick from any to 10.0.0.0/8
> 
> #
> # Permit all Network Critical Machines Access
> #
> pass out quick from 172.20.0.0/24 to any keep state
> pass in quick from any to 172.20.0.0/24
> 
> #
> # Permit all Network Teacher/Staff Computers Access
> #
> pass out quick from 172.20.1.0/24 to any keep state
> pass in quick from any to 172.20.1.0/24


If you remove rule #4 - then there's nothing to allow response traffic
that I can see (unless I'm missing something). I'd guess that if you
remove #4 and add 'keep state' to #5 it'll work.

Aaron