Stephen Mills <[EMAIL PROTECTED]> wrote:
>
> Simply, I would like one workstation *not* to be able to browse the web, and
> the rest of the Class A network to be able to.
Should be no problem.
ipfwadm -F -i reject -S 10.1.2.3/32 -D 0/0 80
This INSERTS a rule at the top of the chain (very important) which
rejects a packet if it is coming from a specific source IP (the one you
want to prevent) and destined for an HTTP service (port 80).
> If I put the deny rule stating that this IP address isnt allowed the
> browse etc, and the rest of the Class A is, rule one gets ignored, and
> all workstations are allowed to browse.
If you appended the rule, then the first catch-all rule will allow the
forwarding operation to proceed. If you put the most-specific rules
first, they will operate the way you expect.
Remember, rules are matched in order, and the first rule that matches
will decide the fate of the packet.
--
[EMAIL PROTECTED] (Fuzzy Fox) || "Nothing takes the taste out of peanut
sometimes known as David DeSimone || butter quite like unrequited love."
http://www.dallas.net/~fox/ || -- Charlie Brown
_______________________________________________
Masq maillist - [EMAIL PROTECTED]
http://tiffany.indyramp.com/mailman/listinfo/masq
Admin requests can be handled by web (above) or [EMAIL PROTECTED]
