Hello Daniel,
Thursday, April 27, 2006, 9:13:02 PM, you wrote:
> hey all,
> here's what I'm looking to do. I know it could be done with IPTABLES, but
> as it's not available for the Mac OS X I'm trying to figure out how it
> would be done in IPFW ...
> RELAY is a workstation forwarding packets from a SOURCE workstation to all
> DESTINATION end points. RELAY is able to receive all packets from SOURCE
> bound to DESTINATION. I want RELAY to deny packets forwarding from SOURCE
> that are name resolution attempts to DESTINATION DNS server specifically
> for host WWW.YAHOO.COM (for example). To do this I need to create a rule
> that will look into the Data field of an DNS packet and match the query.
> The Data field of a DNS query packet would be written in hex.
> With IPTABLES I would write something like this:
> RELAY # iptables -I FORWARD 1 -p udp --dport 53 -m string --hex-string
U have in man ipfw explanation for this.
src and dst: {addr | { addr or ... }} [[not] ports]
An address (or a list, see below) optionally followed by ports
specifiers.
The second format ( or-block with multiple addresses) is provided
for convenience only and its use is discouraged.
addr: [not] {any | me | addr-list | addr-set}
any matches any IP address.
me matches any IP address configured on an interface in the system.
The address list is evaluated at the time the packet is analysed.
addr-list: ip-addr[,addr-list]
ip-addr:
A host or subnet address specified in one of the following ways:
numeric-ip | hostname
Matches a single IPv4 address, specified as dotted-quad
or a hostname. Hostnames are resolved at the time the
rule is added to the firewall list.
So if u want to deny packets from some hostname u have an rule like:
ipfw add 100 deny ip from me to www.hahoo.com
--
Best regards,
vladone mailto:[EMAIL PROTECTED]
_______________________________________________
freebsd-ipfw@freebsd.org mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-ipfw
To unsubscribe, send any mail to "[EMAIL PROTECTED]"
