I wrote script to permit traffic from LAN with 1 MAC 00:1c:c0:f1:cb:c8 to WAN (INTERNET)
Ping goes to any site from ip with this MAC ( with many losts packets) but site doesn't open (i guess because of these losts packets- too big timeout)
. If we remove from script all lines relating to MAC and restart ipfw ,internet works for ip from Table (0) , if sysctl net.link.ether.ipfw=0. In this case there isn't lost packets
Code:
#!/bin/sh -
fwcmd="/sbin/ipfw"
${fwcmd} -f flush
${fwcmd} table all flush
${fwcmd} nat 1 delete
# NETWORK CONNECTIONS
if_inet="igb0"
if_lan="igb1"
# Local
${fwcmd} add allow all from any to any via lo0
${fwcmd} add deny all from any to 127.0.0.0/8
${fwcmd} add deny all from 127.0.0.0/8 to any
# NAT
${fwcmd} nat 1 config if ${if_inet} same_ports reset log
${fwcmd} add nat 1 ip from "table(0)" to any out via ${if_inet}
${fwcmd} add nat 1 ip from any to any in via ${if_inet}
# TABLE (0):
${fwcmd} add allow ip from any to any
${fwcmd} table 0 add 10.44.1.1 etc
# MAC addresses to alow
# These only take effect if sysctl net.link.ether.ipfw=1
GOOD_MACS_F=" { MAC any 00:1c:c0:f1:cb:c8 }"
GOOD_MACS_T=" { MAC 00:1c:c0:f1:cb:c8 any }"
# Allow the ARP traffic from everyone
${fwcmd} add 4 allow ip from any to any layer2 mac-type arp
# Allow traffic from specific MAC addresses
${fwcmd} add 5 allow ip from any to any $GOOD_MACS_F in recv $if_lan
# Allow traffic to specific MAC addresses
${fwcmd} add 6 allow ip from any to any $GOOD_MACS_T out xmit $if_lan
# Allow all IP-level traffic
${fwcmd} add 7 allow ip from any to any via $if_lan
# Deny all MAC-level traffic
${fwcmd} add 8 deny ip from any to any MAC any via $if_lan. If we remove from script all lines relating to MAC and restart ipfw ,internet works for ip from Table (0) , if sysctl net.link.ether.ipfw=0. In this case there isn't lost packets
Last edited: