> Message: 6 > Date: Mon, 26 Apr 1999 17:46:25 -0500 > From: Fuzzy Fox <[EMAIL PROTECTED]> > To: [EMAIL PROTECTED] > Subject: [Masq] Re: Squid and ipfwadm > > > [EMAIL PROTECTED] <[EMAIL PROTECTED]> wrote: > > > > ipfwadm -I -p accept > > ipfwadm -O -p accept > > ipfwadm -F -a m -p accept > > ipfwadm -I -f > > ipfwadm -O -f > > ipfwadm -F -f > > It's not a good idea to set the default forward policy to > "accept/masq". > That causes your firewall to masquerade traffic, no matter which > direction it is going. External systems will appear with as internal > IP's inside your local net, and vice versa. You really only want masq > to operate in one direction. > > Change your default forward policy to "reject", and add a rule that > accept/masq's traffic from the local net going to the outside net. > > You might think this is unrelated to your problem, but you > might also be > wrong. :) > My real ipfwadm masquerading rule is (after flushing and setting my default policy to deny for I O and F): /sbin/ipfwadm -F -a m -S $LocalNet -D $Anywhere The above "accept" rules above are only to test if squid works when there are no deny filters, which so far proves to be the case. > > I read in the Squid documentation that "if you are behind a firewall > > then you can't make direct connections to the outside world, so you > > must use a parent cache." > > No, you are not behind a firewall, because your box is the firewall. > Thanks. _______________________________________________ Masq maillist - [EMAIL PROTECTED] http://tiffany.indyramp.com/mailman/listinfo/masq Admin requests can be handled by web (above) or [EMAIL PROTECTED]
