a) lets say I want to deny everything except a range of IPs
starting from 192.168.1.1 to 192.168.1.50.
what rule set should be? how to set range of IPs? to pass
and deny rest of the C class. FreeBSD Doc's doesnot cover this?
or i didnot see.!
I would set a default to deny, then poke holes through it for the stuff you need, such as
add allow ip from 192.168.1.1/5 to any
add allow ip from any to 192.168.1.1/5
(which sets up to use 1.1 to 1.32). That netmask is your best friend.
b) If i want to deny everything except ip 192.168.1.5 as follow 00400 allow all from 192.168.1.5 to any 01000 deny all from any to any.
when ipfw reads the rules and pass by 00400 then comes to 01000
then it denies even the 192.168.1.5, althou i put this rule before the deny ? what im missing? how should i pass 1 ip and deny all?
It means something didn't even check it with rule 400. This can be due to an IPDIVERT thing changing the address so it doesn't match, or something similar.
c) If I want rule 00400 to expire in 9PM and be active in 8AM.(EXAMPLE)
how do we do that? is it by set a cron job to delete and add
the ipfw rule? or there is something to do from the ipfw it self?
cron job. ipfw doesn't have the capability of doing time-based rulesets. Temporary ones are okay, but time based, it can't really handle.
D) Last Q: IF I restart the box all the rules will be reset,
and comes to default. which is reasonable.
How to keep it everytime I restart?
do i create a file somewhere, and i tell my rc.conf for it?
what the rc.conf line should be? and file format?
Create or edit the '/etc/rc.firewall'. I would only make the changes to allow a firewall type of 'file', and then make rc.conf reference a file that contains the rules. Or, you can add a startup script in /usr/local/etc/rc.d/ that adds the rules.
Joe
_______________________________________________ [EMAIL PROTECTED] mailing list http://lists.freebsd.org/mailman/listinfo/freebsd-questions To unsubscribe, send any mail to "[EMAIL PROTECTED]"
