Server freeze on flushing ipfw

Hi all,

I am working on a shell script that blocks all incoming and outgoing connections for 10 hours. After then hours everything will be unblocked again.

i am using the ipfw command and put it to sleep the amount of time in seconds.

Code: ipfw -q flush ipfw -f add deny tcp from any to any any keep-state setup sleep 36000 ipfw -q flush this works so far, so good.

I am using ipfw nat with the following config

ipfw -q nat 1 config if em0

Which TCP and UDP ranges will the NAT choose its alias ports from?

I need to hack the OS X pf to redirect all ssh connections from an user to this machine.

I set this lines in my rc.conf:

firewall_enable="YES" firewall_type="/etc/ipfw.rules"

cat /etc/ipfw.rules

add 02020 deny ip from table(10) to any add 02030 deny ip from table(11) to any dst-port 25

...

But after reboot, ipfw show :

00100 allow ip from any to any via lo0 00200 deny ip from any to 127.0.0.0/8 00300 deny ip from 127.0.0.0/8 to any 00400 deny ip from any to ::1

This is my situation: I want to connect to an OpenVPN server from my office (we're using a proxy, only ports 80 and 443 are allowed).

Server IP address is: 176.31.250.232:843

My static IP address is: 192.168.78.241

Is possibile to forward the 843 TCP port to the 443 port using IPFW? (I'm on OSX).

Thanks for the answers.

As I notice more often with FreeBSD, there are always plenty of ways that lead to some specific goal.

After figuring out which firewall I wanted (I choose ipfw) I now am completely insecure about which way to do Network Address Translation (NAT).

As I have discovered now, there are two ways to to NAT, I could use the kernel space ipfw nat or I could use the userspace natd.

I need to do the following (but I'm on Mac OS X):-

iptables -A INPUT -p tcp -s 123.456.789.0 --sport 1234 --tcp-flags RST RST -j DROP

So I need to use pfctl (I think? As ipfw is apparently deprecated?)

I just need a direct translation of the iptables command to one I can use.

I would like to lead some traffic through a transparent proxy (which actually is on another server and connected with an ssh tunnel).

Normally I could do this:

ipfw add forward localhost,8080 tcp from any to x.x.x.x 80

However, fwd/forward needs a re-compile of the kernel, which I am not happy to do.

I have the following ipfw settings on my Mac OS X 10.4 Tiger:

00100 allow ip from any to 123.123.123.123 00110 allow tcp from any to 123.123.123.123 00120 allow udp from any to 123.123.123.123 00130 allow ip from 123.123.123.123 to any 00140 allow tcp from 123.123.123.123 to any 00150 allow udp from 123.123.123.123 to any 65534 deny ip from any to any 65535 allow ip from any to any

I am trying