[FUGSPBR] Bridge-Firewall com politica fechada

[Clayton Silva Lima]

Vc pode incluir no kernel:

options        IPFIREWALL_DEFAULT_TO_ACCEPT

Assim nao precisara incluir a regra manualmente no ipfw.rules.


 Atenciosamente,

 Clayton Silva Lima
 URBI Network
 http://www.aganet.com.br
 http://www.urbi.com.br

----- Original Message ----- 
From: "Honorio Ribeiro Filho" <honorior em insidenet.com.br>
To: <fugspbr em fugspbr.org>
Sent: Tuesday, June 15, 2004 7:35 PM
Subject: [FUGSPBR] Bridge-Firewall com politica fechada


>       PessoALL, já estou quase desistindo. Tentei com as versões 5.0, e
> 5.2.1 agora. Compilei com o bridge habilitado e preciso usar politica
> fechada, só sai para a internet alguns IPs, porém, se a política não
estiver
> aberta não passa nada. Vou postar as cfgs.
>       Peço a gentileza dos colegas de darem uma ajuda nessa empreitada.
> linhas incluidas no Kernel
> options         BRIDGE
> options         IPDIVERT
> options         DUMMYNET
> options         IPFIREWALL
> options         IPFIREWALL_FORWARD
> options         IPFIREWALL_VERBOSE
> options         IPFIREWALL_VERBOSE_LIMIT=20
>
> ipfw -a list
> 00100    0     0 allow ip from any to any via lo0
> 00200    0     0 deny ip from any to 127.0.0.0/8
> 00300    0     0 deny ip from 127.0.0.0/8 to any
> 00400   82  6752 allow ip from 200.143.71.250 to any   <---- ip da bridge
> 00500  166 11300 allow ip from any to 200.143.71.250
> 00600    5   240 allow ip from 200.143.71.245 to any     <---- ip da
estação
> 00700    5   264 allow ip from any to 200.143.71.245
> 65534 1096 51421 allow ip from any to any     <---- incluída manualmente
> 65535  413 34528 deny ip from any to any
>
>          Pq sem a regra 65534 não consigo pingar nada, nem da estação nem
da
> bridge?
>          As variáveis do sysctl estão assim:
> bridge# sysctl -a | grep bridge
> net.link.ether.bridge.debug: 0
> net.link.ether.bridge.ipf: 1
> net.link.ether.bridge.ipfw: 1
> net.link.ether.bridge.copy: 0
> net.link.ether.bridge.ipfw_drop: 0
> net.link.ether.bridge.ipfw_collisions: 0
> net.link.ether.bridge.packets: 2800
> net.link.ether.bridge.dropped: 0
> net.link.ether.bridge.predict: 2567
> net.link.ether.bridge.enable: 1
> net.link.ether.bridge.config: sis0:0,rl0:0
> net.link.ether.bridge_ipf: 1
> net.link.ether.bridge_ipfw: 1
> net.link.ether.bridge_cfg: sis0:0,rl0:0
> net.inet.ip.fw.one_pass: 1   <--- Já tentei com essa opção =0
>
> bridge# sysctl -a | grep fw
> net.inet.ip.fw.enable: 1
> net.inet.ip.fw.autoinc_step: 100
> net.inet.ip.fw.one_pass: 1
> net.inet.ip.fw.debug: 1
> net.inet.ip.fw.verbose: 1
> net.inet.ip.fw.verbose_limit: 20
> net.inet.ip.fw.dyn_buckets: 256
> net.inet.ip.fw.curr_dyn_buckets: 256
> net.inet.ip.fw.dyn_count: 0
> net.inet.ip.fw.dyn_max: 4096
> net.inet.ip.fw.static_count: 9
> net.inet.ip.fw.dyn_ack_lifetime: 300
> net.inet.ip.fw.dyn_syn_lifetime: 20
> net.inet.ip.fw.dyn_fin_lifetime: 1
> net.inet.ip.fw.dyn_rst_lifetime: 1
> net.inet.ip.fw.dyn_udp_lifetime: 10
> net.inet.ip.fw.dyn_short_lifetime: 5
> net.inet.ip.fw.dyn_keepalive: 1
> net.link.ether.bridge.ipfw: 1
> net.link.ether.bridge.ipfw_drop: 0
> net.link.ether.bridge.ipfw_collisions: 0
> net.link.ether.bridge_ipfw: 1
> net.link.ether.ipfw: 1
>
> bridge# ifconfig
> sis0: flags=8943<UP,BROADCAST,RUNNING,PROMISC,SIMPLEX,MULTICAST> mtu 1500
>         inet 200.143.71.250 netmask 0xffffff00 broadcast 200.143.71.255
>         ether 00:50:2c:05:13:10
>         media: Ethernet autoselect (100baseTX <full-duplex>)
>         status: active
> rl0: flags=8943<UP,BROADCAST,RUNNING,PROMISC,SIMPLEX,MULTICAST> mtu 1500
>         options=8<VLAN_MTU>
>         inet 192.168.25.254 netmask 0xffffff00 broadcast 192.168.25.255
>         ether 00:00:21:d8:f1:bd
>         media: Ethernet autoselect (100baseTX <full-duplex>)
>         status: active
> lo0: flags=8049<UP,LOOPBACK,RUNNING,MULTICAST> mtu 16384
>         inet 127.0.0.1 netmask 0xff000000
>
> _______________________________________________________________
> Para enviar um novo email para a lista: fugspbr em fugspbr.org
> Sair da Lista: http://lists.fugspbr.org/listinfo.cgi
> Historico: http://www4.fugspbr.org/lista/html/FUG-BR/
>
>


_______________________________________________________________
Para enviar um novo email para a lista: fugspbr em fugspbr.org
Sair da Lista: http://lists.fugspbr.org/listinfo.cgi
Historico: http://www4.fugspbr.org/lista/html/FUG-BR/