Subject: Question about IPFilter and local connections being refused.
To: None <netbsd-help@netbsd.org>
From: Sean J. Schluntz <schluntz@workofstone.com>
List: netbsd-help
Date: 04/09/2002 11:07:21
I have the following rules (at end of message) setup on a NetBSD/sparc 1.5.2
system (with the kernel set to default drop).  It can connect out to other
systems with out a problem (even systems it has to go through the gateway
for) and other systems can connect in to the box on the ports that are
open.

The problem is that I can't connect to any of the ports locally, if I
try:

telnet localhost 110
  or
telnet 10.0.0.110 110

I get the following error:

telnet: Unable to connect to remote host: No route to host

Which confuses me, the routes are there (the local IP address is 10.0.0.110):

  $ netstat -rn
  Routing tables
 
  Internet:
  Destination        Gateway            Flags     Refs     Use    Mtu  Interface
  default            10.0.0.100         UGS         0        1   1500  le0
  10/24              link#1             UC          3        0   1500  le0
  10.0.0.1           00:a0:cc:3b:90:af  UHLc        1       80   1500  le0
  10.0.0.100         00:00:c0:5e:b3:0b  UHLc        1        0   1500  le0
  10.0.0.110         08:00:20:77:06:12  UHLc        0        1   1500  lo0
  127                127.0.0.1          UGRS        0        0  33228  lo0
  127.0.0.1          127.0.0.1          UH          2        1  33228  lo0

I've tried going so far as to add:
  pass in quick on lo0 proto tcp from any to any
  pass in quick on le0 proto tcp from 10.0.0.110/32 to 10.0.0.110/32

to the /etc/ipf.conf file but it doesn't help.  The system works just fine
when the firewall is not loaded.

Does anyone have any ideas as to what I'm doing wrong?  I've looked through
the lists, and see mention of this kind of error but I don't see any 
responces.

Thanks for your help!
-Sean

/etc/ipf.conf

  # Block all traffic if it not now allowed below
  block in on le0 all
   
  # Allow the system to act as an Internet client
  pass out quick on le0 proto tcp from 10.0.0.110/32 to any keep state
  pass out quick on le0 proto udp from 10.0.0.110/32 to any keep state
  pass out quick on le0 proto icmp from 10.0.0.110/32 to any keep state
   
  # Allow inbound ssh connections
  pass in quick on le0 proto tcp from any to 10.0.0.110/32 port = 22 keep state
   
  # Allow inbound smtp connections
  pass in quick on le0 proto tcp from any to 10.0.0.110/32 port = 25 keep state
   
  # Allow inbound DNS connections
  pass in quick on le0 proto tcp from any to 10.0.0.110/32 port = 53 keep state
  pass in quick on le0 proto udp from any to 10.0.0.110/32 port = 53 keep state
   
  # Allow inbound pop3(s) connections
  pass in quick on le0 proto tcp from any to 10.0.0.110/32 port = 110 keep state
  #pass in quick on le0 proto tcp from any to 10.0.0.110/32 port = 995 keep state
 
  # Allow inbound imap(s) connections
  pass in quick on le0 proto tcp from any to 10.0.0.110/32 port = 143 keep state
  #pass in quick on le0 proto tcp from any to 10.0.0.110/32 port = 993 keep state