Board index Freebsd

port forwarding with ipfw/natd

port forwarding with ipfw/natd

Post by Ean Kingsto » Fri, 06 Aug 1999 04:00:00



I'm trying to setup my firewall (FreeBSD 3.2, ipfw/natd) to forward tcp
connections to a single port (57) on the Internet interface to a specific
system on the inside network (192.168.89.3:22).  In going through the man
page for ipfw I figured the "fwd" directive was the way to go but it
doesn't seam to work, or maybe I'm missing something.  I've added the
following directive to the "simple" firewall section of rc.firewall

        add fwd 192.168.89.3,22 tcp from any to x.x.x.x 57 via ed1

The x.x.x.x is my Internet address on ed1 (ed0 is my internal address).

Should I be doing this through the natd program instead of ipfw or am I
just missing something?

--

Ean Kingston
Just another faceless name on the Internet.
URL: http://www.korax.net/~ean

 
 
 
Top

port forwarding with ipfw/natd

Post by Tony Voe » Sat, 07 Aug 1999 04:00:00



> I'm trying to setup my firewall (FreeBSD 3.2, ipfw/natd) to forward tcp
> connections to a single port (57) on the Internet interface to a specific
> system on the inside network (192.168.89.3:22).  In going through the man
> page for ipfw I figured the "fwd" directive was the way to go but it
> doesn't seam to work, or maybe I'm missing something.  I've added the
> ...

The "fwd" directive is intended for use with transparent proxy servers. I don't
know if it's supposed to do port redirection. Anyhow, this should do the trick:

Add this to /etc/rc.conf:

natd_flags="-redirect_port tcp 192.168.89.3:ssh mtp"

And add this ipfw rule:

add pass log tcp from any to x.x.x.x mtp in via ed1

tv

 
 
 
Top

port forwarding with ipfw/natd

Post by Chris Smit » Sat, 07 Aug 1999 04:00:00


I will post a copy of my ipfw list.  It works very well for me.  Just
duplicate it on your system and it should work just fine!

xxx.xxx.xxx.0 is my public IP class c (change it to yours)
192.168.0.0 is my private IP class c (change it to yours)

00100 divert 8668 ip from any to any via ed0
00100 allow ip from any to any via lo0
00200 deny ip from any to 127.0.0.0/8
00300 divert 8668 ip from any to any via ed0
00400 deny ip from xxx.xxx.xxx.0/24 to any in recv ed1
00500 deny ip from 192.168.0.0/16 to any in recv ed0
00600 deny ip from 172.16.0.0/12 to any in recv ed0
00700 deny ip from 10.0.0.0/8 to any in recv ed0
00800 deny ip from 127.0.0.0/8 to any in recv ed0
00900 allow ip from any to 192.168.0.0/24
01000 allow ip from any to xxx.xxx.xxx.0/24
01100 allow ip from 192.168.0.0/24 to any
01200 allow ip from xxx.xxx.xxx.0/24 to any
65534 deny log ip from any to any

With this ruleset you should be up and running in no time!

Chris Smith


> I'm trying to setup my firewall (FreeBSD 3.2, ipfw/natd) to forward tcp
> connections to a single port (57) on the Internet interface to a specific
> system on the inside network (192.168.89.3:22).  In going through the man
> page for ipfw I figured the "fwd" directive was the way to go but it
> doesn't seam to work, or maybe I'm missing something.  I've added the
> following directive to the "simple" firewall section of rc.firewall

> add fwd 192.168.89.3,22 tcp from any to x.x.x.x 57 via ed1

> The x.x.x.x is my Internet address on ed1 (ed0 is my internal address).

> Should I be doing this through the natd program instead of ipfw or am I
> just missing something?

> --

> Ean Kingston
> Just another faceless name on the Internet.
> URL: http://www.korax.net/~ean


 
 
 
Top

port forwarding with ipfw/natd

Post by charli » Mon, 09 Aug 1999 04:00:00


I found this c program which would probably do what you want, it's called
datapipe.  You can get it at:
http://www.chaostic.com/filez/exploites/datapipe.c

> I'm trying to setup my firewall (FreeBSD 3.2, ipfw/natd) to forward tcp
> connections to a single port (57) on the Internet interface to a specific
> system on the inside network (192.168.89.3:22).  In going through the man
> page for ipfw I figured the "fwd" directive was the way to go but it
> doesn't seam to work, or maybe I'm missing something.  I've added the
> following directive to the "simple" firewall section of rc.firewall

>         add fwd 192.168.89.3,22 tcp from any to x.x.x.x 57 via ed1

> The x.x.x.x is my Internet address on ed1 (ed0 is my internal address).

> Should I be doing this through the natd program instead of ipfw or am I
> just missing something?

> --

> Ean Kingston
> Just another faceless name on the Internet.
> URL: http://www.korax.net/~ean


 
 
 
Top

1. HELP - IPFW with NATD for port forwarding

I am having a problem getting my FreeBSD 4.3 IPFW firewall to forward
incoming FTP requests to a server on a private network.  I have scoured
dejanews and the like and all the previous post seem to say the same thing.
NATD redirect_port entries in NATD.CONF and a ADD ALLOW statement in the
firewall script as noted in the script below.

Natd.conf entries ar as follows:

use_sockets yes
redirect_port tcp 192.168.1.3:21 21
redirect_port udp 192.168.1.3:21 21

natd.conf is of course called in rc.conf via natd_flags="-f /etc/natd.conf"

And here is my firewall script:

fwcmd="/sbin/ipfw" #leave as is if using ipfw
oif="oifx"  #set to outside interface name
onwr="a.b.c.d/24" #set to outside network range
oip="a.b.c.d"  #set to outside ip address

iif="ifx"  #set to internal interface name
inwr="x.y.z.x/24" #set to internal network range
iip="x.y.z.x"  #set to internal ip address

ns1="e.f.g.h"  #set to primary name server best if = oif
#ntp="i.j.k.l"  #set to ip of NTP server or leave as is

 $fwcmd -f flush

 $fwcmd add allow all from any to any via lo0
 $fwcmd add deny log all from any to 127.0.0.0/8

 $fwcmd add deny log ip from $inwr to any in via $oif

 $fwcmd add deny log ip from not $inwr to any in via $iif

 $fwcmd add deny log ip from 192.168.0.0/16 to any in via $oif
 $fwcmd add deny log ip from 172.16.0.0/12 to any in via $oif
 $fwcmd add deny log ip from 10.0.0.0/8 to any in via $oif
 $fwcmd add deny log ip from any to 192.168.0.0/16 in via $oif
 $fwcmd add deny log ip from any to 172.16.0.0/12 in via $oif
 $fwcmd add deny log ip from any to 10.0.0.0/8 in via $oif

 $fwcmd add deny all from 0.0.0.0/8 to any in via $oif
 $fwcmd add deny all from 169.254.0.0/16 to any in via $oif
 $fwcmd add deny all from 192.0.2.0/24 to any in via $oif
 $fwcmd add deny all from 224.0.0.0/4 to any in via $oif
 $fwcmd add deny all from 240.0.0.0/4 to any in via $oif
 $fwcmd add deny all from any to 0.0.0.0/8 in via $oif
 $fwcmd add deny all from any to 169.254.0.0/16 in via $oif
 $fwcmd add deny all from any to 192.0.2.0/24 in via $oif
 $fwcmd add deny all from any to 224.0.0.0/4 in via $oif
 $fwcmd add deny all from any to 240.0.0.0/4 in via $oif

 $fwcmd add divert natd all from any to any via $oif

 $fwcmd add allow tcp from any to any established
 $fwcmd add allow tcp from any to $oip 22 setup
 $fwcmd add allow log tcp from any to <publicaddress> 21 via $oif
<---------------Add Allow statement

 $fwcmd add allow icmp from any to any icmptypes 3,4,11,12
 $fwcmd add allow udp from any 53 to $ns1 53
 $fwcmd add check-state
 $fwcmd add allow ip from $oip to any keep-state out via $oif
 $fwcmd add allow ip from $inwr to any keep-state via $iif

 $fwcmd add 65435 deny log ip from any to any  <---------------------Is this
line cancelling out my Add Allow above?

Any help would be appriciated.

TIA

Rob

2. A dumb networking question

3. Port Forwarding, ipfw + natd

4. Linux & cdrom

5. ipfw / natd port forwarding.

6. extracting man pages

7. ipfw, freebsd 4.6, natd redirected ports (NOT)

8. HACMP / Shared volume groups

9. ipfw + natd; port redirection problem

10. Do I need port redirection in my box running IPFW and NATD?

11. need help with port redirects using natd/ipfw

12. natd port forwarding disappeared

13. NATD and port forwarding (for quake)


All times are UTC
Board index