Subject: Re: ipnat rules for firewall
To: None <psapprich@mindspring.com>
From: Laine Stump <lainestump@rcn.com>
List: netbsd-help
Date: 07/16/2000 22:11:15
(Followup redirected to netbsd-help@netbsd.org)

At 08:57 PM 7/16/00 -0400, psapprich@mindspring.com wrote:

>      There seems to be some problems with the firewall rules. I had even 
> tried 'pass in all / pass out all', the LED's on the cable modem flash in 
> sync with the browser clicks on the station on the local network, but no 
> packets seem to be coming back.

Are you watching the output of "ipmon" to see if packets are being rejected?

This works for me (tlp1 is external interface, tlp0 is internal):

pass in  quick on tlp0 from any to any
pass out quick on tlp0 from any to any
pass in  quick on tlp1 from any to any
pass out quick on tlp1 from any to any

Beyond that, set ipnat.conf to something like this (this one assumes you 
want your internal network to be 10.0.0.0/24, and tlp1 is the external 
interface):

map tlp1 10.0.20.0/24 -> 0.0.0.0/32 proxy port ftp ftp/tcp
map tlp1 10.0.20.0/24 -> 0.0.0.0/32 proxy port 7070 raudio/tcp
map tlp1 10.0.20.0/24 -> 0.0.0.0/32 portmap tcp/udp 10000:65000
map tlp1 10.0.20.0/24 -> 0.0.0.0/32

Once you have it working like that, you can start adding more stuff to 
ipf.conf (don't want to leave it wide open like that!).