From owner-FreeBSD-net-jp@jp.freebsd.org  Thu Dec 14 17:15:50 2000
Received: (from daemon@localhost)
	by castle.jp.freebsd.org (8.9.3+3.2W/8.7.3) id RAA55206;
	Thu, 14 Dec 2000 17:15:50 +0900 (JST)
	(envelope-from owner-FreeBSD-net-jp@jp.FreeBSD.org)
Received: from ns.mmc.co.jp (ns.mmc.co.jp [202.33.246.162])
	by castle.jp.freebsd.org (8.9.3+3.2W/8.7.3) with ESMTP id RAA55201
	for <FreeBSD-net-jp@jp.freebsd.org>; Thu, 14 Dec 2000 17:15:49 +0900 (JST)
	(envelope-from ueno@mmc.co.jp)
Received: from mailhub.sys.mmc.co.jp ([172.17.10.2])
	by ns.mmc.co.jp (8.9.3/3.7W) with ESMTP id QAA24540
	for <FreeBSD-net-jp@jp.freebsd.org>; Thu, 14 Dec 2000 16:49:17 +0900
Received: from kueno.mmc.co.jp ([172.20.111.254]) by mailhub.sys.mmc.co.jp (8.8.8/HUB2.00) with ESMTP id RAA20304 for <FreeBSD-net-jp@jp.freebsd.org>; Thu, 14 Dec 2000 17:04:25 +0900
Received: from localhost (localhost. [127.0.0.1]) by kueno.mmc.co.jp (8.9.3/3.7W-0012102225) with ESMTP id RAA01350 for <FreeBSD-net-jp@jp.freebsd.org>; Thu, 14 Dec 2000 17:16:05 +0900 (JST)
To: FreeBSD-net-jp@jp.freebsd.org
From: =?iso-2022-jp?B?GyRCPmVMbjlAMGwbKEI=?= <kueno@mmc.co.jp>
In-Reply-To: <200012140736.eBE7a4601483@kiri.pis>
References: <200012140736.eBE7a4601483@kiri.pis>
X-Mailer: Mew version 1.94.2 on Emacs 19.34 / Mule 2.3 (SUETSUMUHANA)
Mime-Version: 1.0
Content-Type: Text/Plain; charset=iso-2022-jp
Content-Transfer-Encoding: 7bit
Message-Id: <20001214171605Z.ueno@mmc.co.jp>
Date: Thu, 14 Dec 2000 17:16:05 +0900
X-Dispatcher: imput version 20000228(IM140)
Lines: 40
Reply-To: FreeBSD-net-jp@jp.freebsd.org
Precedence: list
X-Distribute: distribute version 2.1 (Alpha) patchlevel 24e+000315
X-Sequence: FreeBSD-net-jp 2888
Subject: [FreeBSD-net-jp 2888] netmask =?ISO-2022-JP?B?GyRCJEgbKEI=?= ipfw
Errors-To: owner-FreeBSD-net-jp@jp.freebsd.org
Sender: owner-FreeBSD-net-jp@jp.freebsd.org
X-Originator: ueno@mmc.co.jp

$B>eLn$H?=$7$^$9!#(B

192.168.1.0/255.255.255.0      192.168.1.128/255.255.255.0    
<----------------------[firewall]---------------
          |     192.168.1.2  192.168.1.129 |
          |                                |
          |192.168.1.3                     |192.168.1.191
       [HOST-B]                        [HOST-A]

$B>e$N$h$&$J%M%C%H%o!<%/$rAH$s$G$$$^$9!#(Bfirewall_type="open"
$B$K$9$l$P(BHOST-A$B$+$i(BHOST-B$B$X=P$F9T$/$3$H$,$G$-$^$9!#(B

$B$7$+$7(Bfirewall_type="simple"$B$K$9$k$H(BHOST-A$B$b(Bfirewall$B$b(BHOST-B$B$XBP$7$F(B
ping$B$b=PMh$J$/$J$j$^$9!#(Bhost-A$B!c!]!d(Bfirewall$B4V$N(Bping$B$O=PMh$^$9!#(B

/etc/rc.firewall$B$N@_Dj$K4V0c$$$,$"$k$N$@$H;W$$$^$9$,!"0J2<$N$h$&$K$J$C(B 
$B$F$$$^$9!#(B $B$$$m$$$m;n$7$?$N$G$9$,$I$3$,0-$$$+$o$+$j$^$;$s!#$I$J$?$+$4(B
$B;XE&$$$?$@$1$^$;$s$+!)(B

# set these to your outside interface network and netmask and ip
        oif="de0"
        onet="192.168.1.0"
        omask="255.255.255.128"
        oip="192.168.1.2"

# set these to your inside interface network and netmask and ip
        iif="xl0"
        inet="192.168.1.128"
        imask="255.255.255.128"
        iip="192.168.1.129"

# Stop spoofing
        ${fwcmd} add deny all from ${inet}:${imask} to any in via ${oif}
        ${fwcmd} add deny all from ${onet}:${omask} to any in via ${iif}

# Allow LAN traffic
        ${fwcmd} add allow all from 192.168.1.0:255.255.255.128 to any via ${iif}
        ${fwcmd} add allow all from any to 192.168.1.0:255.255.255.128 via ${iif}


