On Fri, 21 Jan 2005 08:20:45 -0600, Andrew L. Gould <[EMAIL PROTECTED]> wrote: > I'm running pf in FreeBSD 5.3 on my laptop. The filters for the local > box work fine. > > I'm also working on a pc for a friend; but ran out of ethernet ports in > my router. This pc doesn't have a wireless adapter; so I adjusted my > pf rules to use my laptop as a gateway for the pc. > > I want my filters to remain intact for the laptop; but I want nat to let > all the pc's traffic through. (It has it's own firewall.) According > the OpenBSD pf tutorial, adding the word 'pass' after 'nat' in the nat > command will allow nat traffic to bypass the filter rules. > Unfortunately, this doesn't seem to work. > > If my default 'block log all' rule is left uncommented, I can only ping > ip addresses (not host names that require nameservers). No other > activity passes through. If I comment it out, all traffic passes; but > my laptop is left unprotected. > > Any advice? > > The relevant lines from my pf rules follow: > > ifdev = "ath0" > natdev = "fxp0" > scrub in all no-df > nat pass on $ifdev from $natdev:network to any -> $ifdev > icmp_types = "echoreq" > block log all > #other filtering rules follow > > Thanks, > > Andrew Gould How about something like this: EXT_IF = "fxp0" INT_IF = "xl0"
TCP_OUT = "{ ssh, www, https, smtp, pop3 }" UDP_OUT = "{ domain }" ICMP_OUT = "echoreq" scrub in all no-df nat on $EXT_IF from $INT_IF:network to any -> $EXT_IF # -- default policy block log from any to any # -- LOOPBACK pass quick on lo0 from any to any # -- EXTERNAL # -- tcp pass out quick on $EXT_IF inet proto tcp from any to any port $TCP_OUT flags S/SA keep state # -- udp pass out quick on $EXT_IF inet proto udp from any to any port $UDP_OUT keep state # -- icmp pass out quick on $EXT_IF inet proto icmp from any to any icmp-type $ICMP_OUT keep state # -- INTERNAL pass on $INT_IF from any to any =Adriaan== _______________________________________________ freebsd-questions@freebsd.org mailing list http://lists.freebsd.org/mailman/listinfo/freebsd-questions To unsubscribe, send any mail to "[EMAIL PROTECTED]"