[FUGSPBR] Bridge-Firewall com politica fechada

[Honorio Ribeiro Filho]

      PessoALL, já estou quase desistindo. Tentei com as versões 5.0, e
5.2.1 agora. Compilei com o bridge habilitado e preciso usar politica
fechada, só sai para a internet alguns IPs, porém, se a política não estiver
aberta não passa nada. Vou postar as cfgs.
      Peço a gentileza dos colegas de darem uma ajuda nessa empreitada.
linhas incluidas no Kernel
options         BRIDGE
options         IPDIVERT
options         DUMMYNET
options         IPFIREWALL
options         IPFIREWALL_FORWARD
options         IPFIREWALL_VERBOSE
options         IPFIREWALL_VERBOSE_LIMIT=20

ipfw -a list
00100    0     0 allow ip from any to any via lo0
00200    0     0 deny ip from any to 127.0.0.0/8
00300    0     0 deny ip from 127.0.0.0/8 to any
00400   82  6752 allow ip from 200.143.71.250 to any   <---- ip da bridge
00500  166 11300 allow ip from any to 200.143.71.250
00600    5   240 allow ip from 200.143.71.245 to any     <---- ip da estação
00700    5   264 allow ip from any to 200.143.71.245
65534 1096 51421 allow ip from any to any     <---- incluída manualmente
65535  413 34528 deny ip from any to any

         Pq sem a regra 65534 não consigo pingar nada, nem da estação nem da
bridge?
         As variáveis do sysctl estão assim:
bridge# sysctl -a | grep bridge
net.link.ether.bridge.debug: 0
net.link.ether.bridge.ipf: 1
net.link.ether.bridge.ipfw: 1
net.link.ether.bridge.copy: 0
net.link.ether.bridge.ipfw_drop: 0
net.link.ether.bridge.ipfw_collisions: 0
net.link.ether.bridge.packets: 2800
net.link.ether.bridge.dropped: 0
net.link.ether.bridge.predict: 2567
net.link.ether.bridge.enable: 1
net.link.ether.bridge.config: sis0:0,rl0:0
net.link.ether.bridge_ipf: 1
net.link.ether.bridge_ipfw: 1
net.link.ether.bridge_cfg: sis0:0,rl0:0
net.inet.ip.fw.one_pass: 1   <--- Já tentei com essa opção =0

bridge# sysctl -a | grep fw
net.inet.ip.fw.enable: 1
net.inet.ip.fw.autoinc_step: 100
net.inet.ip.fw.one_pass: 1
net.inet.ip.fw.debug: 1
net.inet.ip.fw.verbose: 1
net.inet.ip.fw.verbose_limit: 20
net.inet.ip.fw.dyn_buckets: 256
net.inet.ip.fw.curr_dyn_buckets: 256
net.inet.ip.fw.dyn_count: 0
net.inet.ip.fw.dyn_max: 4096
net.inet.ip.fw.static_count: 9
net.inet.ip.fw.dyn_ack_lifetime: 300
net.inet.ip.fw.dyn_syn_lifetime: 20
net.inet.ip.fw.dyn_fin_lifetime: 1
net.inet.ip.fw.dyn_rst_lifetime: 1
net.inet.ip.fw.dyn_udp_lifetime: 10
net.inet.ip.fw.dyn_short_lifetime: 5
net.inet.ip.fw.dyn_keepalive: 1
net.link.ether.bridge.ipfw: 1
net.link.ether.bridge.ipfw_drop: 0
net.link.ether.bridge.ipfw_collisions: 0
net.link.ether.bridge_ipfw: 1
net.link.ether.ipfw: 1

bridge# ifconfig
sis0: flags=8943<UP,BROADCAST,RUNNING,PROMISC,SIMPLEX,MULTICAST> mtu 1500
        inet 200.143.71.250 netmask 0xffffff00 broadcast 200.143.71.255
        ether 00:50:2c:05:13:10
        media: Ethernet autoselect (100baseTX <full-duplex>)
        status: active
rl0: flags=8943<UP,BROADCAST,RUNNING,PROMISC,SIMPLEX,MULTICAST> mtu 1500
        options=8<VLAN_MTU>
        inet 192.168.25.254 netmask 0xffffff00 broadcast 192.168.25.255
        ether 00:00:21:d8:f1:bd
        media: Ethernet autoselect (100baseTX <full-duplex>)
        status: active
lo0: flags=8049<UP,LOOPBACK,RUNNING,MULTICAST> mtu 16384
        inet 127.0.0.1 netmask 0xff000000

_______________________________________________________________
Para enviar um novo email para a lista: fugspbr em fugspbr.org
Sair da Lista: http://lists.fugspbr.org/listinfo.cgi
Historico: http://www4.fugspbr.org/lista/html/FUG-BR/