I have tried enabling IPFW with NAT support on a Freebsd 7.0(RC) Server... when I reboot I am locked out and the help desk has to turnoff the firewall
here is my config and thoughts
rc.conf
natd.conf
/usr/local/etc/openvpn/ipfw.rules
any thoughts??
here is my config and thoughts
rc.conf
Code:
defaultrouter="xx.xxx.184.1"
hostname=""
ifconfig_rl0="inet xx.xxx.xx.124 netmask 255.255.252.0"
ifconfig_rl0_alias0="inet yy.yyy.yy.yy netmask 255.0.0.0"
linux_enable="YES"
sshd_enable="YES"
webmin_enable="YES"
mysql_enable="YES"
apache22_enable="YES"
named_enable="YES"
clamsmtpd_enable="YES"
clamav_clamd_enable="YES"
clamav_freshclam_enable="YES"
clamav_milter_enable="YES"
#darwin_streaming_server_enable="YES"
#darwin_streaming_server_flags=""
#streamingadminserver_enable="YES"
#streamingadminserver_flags=""
amavis_milter_enable="YES"
amavisd_enable="YES"
clamav_clamd_enable="YES"
clamav_milter_enable="YES"
dovecot_enable="YES"
proftpd_enable="YES"
openvpn_enable="YES"
openvpn_configfile="/usr/local/etc/openvpn/server.conf"
openvpn_if="tun"
postgrey_enable="YES"
netatalk_enable="YES"
afpd_enable="YES"
mdnsresponder_enable="YES"
mdnsresponder_flags="-f /usr/local/etc/mDNSResponder.conf"
gateway_enable="YES"
firewall_enable="YES"
#firewall_type="open"
firewall_script="/usr/local/etc/ipfw.rules"
natd_enable="YES"
natd_interface="rl0"
natd_flags="-f /etc/natd.conf"
natd.conf
Code:
interface rl0
use_sockets yes
same_ports yes
/usr/local/etc/openvpn/ipfw.rules
Code:
IPF="ipfw -q add
ipfw -q -f flush
ipfw nat 1 config if tun0
#loopback
$IPF 10 allow all from any to any via lo0
$IPF 20 deny all from any to 127.0.0.0/8
$IPF 30 deny all from 127.0.0.0/8 to any
$IPF 40 deny tcp from any to any frag
# statefull
$IPF 50 check-state
$IPF 55 allow all from any to any via tun0
$IPF 60 allow tcp from any to any established
$IPF 61 allow tcp from any to me dst-port 1194 setup
$IPF 62 allow udp from any to me dst-port 1194
$IPF 63 allow udp from me to any
$IPF 70 allow all from any to any out keep-state
$IPF 80 allow icmp from any to any
# open port ftp (20,21), ssh (22), mail (25)
# http (80), dns (53) etc
$IPF 110 allow tcp from any to any 21 in
$IPF 120 allow tcp from any to any 21 out
$IPF 130 allow tcp from any to any 22 in
$IPF 140 allow tcp from any to any 22 out
$IPF 150 allow tcp from any to any 25 in
$IPF 160 allow tcp from any to any 25 out
$IPF 162 allow tcp from any to any 2500 in
$IPF 164 allow tcp from any to any 2500 out
$IPF 170 allow udp from any to any 53 in
$IPF 175 allow tcp from any to any 53 in
$IPF 180 allow udp from any to any 53 out
$IPF 185 allow tcp from any to any 53 out
$IPF 200 allow tcp from any to any 80 in
$IPF 210 allow tcp from any to any 80 out
$IPF 211 allow tcp from any to any 143 in
$IPF 212 allow tcp from any to any 143 out
$IPF 213 allow tcp from any to any 443 in
$IPF 214 allow tcp from any to any 443 out
$IPF 215 allow tcp from any to any 554 in
$IPF 216 allow udp from any to any 554 out
$IPF 220 allow tcp from any to any 993 in
$IPF 221 allow tcp from any to any 993 out
$IPF 222 allow tcp from any to any 995 in
$IPF 223 allow tcp from any to any 995 out
$IPF 230 allow udp from any to any 1194 in
$IPF 231 allow tcp from any to any 1194 in
$IPF 232 allow tcp from any to any 1194 out
$IPF 233 allow udp from any to any 1194 out
$IPF 300 allow tcp from any to any 9000 in
$IPF 310 allow tcp from any to any 9000 out
$IPF 400 allow tcp from any to any 8080 in
$IPF 401 allow tcp from any to any 8080 out
# deny and log everything
$IPF 500 deny log all from any to any
any thoughts??