<!DOCTYPE HTML PUBLIC "-//W3C//DTD W3 HTML//EN">
<HTML>
<HEAD>
<META content=text/html;charset=iso-8859-1 http-equiv=Content-Type>
<META content='"MSHTML 4.72.3612.1706"' name=GENERATOR>
</HEAD>
<BODY bgColor=#ffffff>
<DIV><FONT color=#000000 size=2>Hi </FONT></DIV>
<DIV><FONT color=#000000 size=2>I am have a small lan that works well with wide
open forwarding and masq through my RR box.(RH5.2)</FONT></DIV>
<DIV><FONT color=#000000 size=2></FONT> </DIV>
<DIV><FONT color=#000000 size=2>I have been trying to work up a firewall using
ipfwadm and the Fire wall tool at <A
href="http://rlz.ne.mediaone.net/linux/firewall/index.html">http://rlz.ne.mediaone.net/linux/firewall/index.html</A></FONT></DIV>
<DIV><FONT color=#000000 size=2></FONT> </DIV>
<DIV><FONT color=#000000 size=2>I think I uderstand the filter concept, but am
having trouble with one of the rule styles</FONT></DIV>
<DIV><FONT color=#000000 size=2>the firewall tool generates. It sets a variable
EXTERNAL_INTERFACE ="eth0". This is the </FONT></DIV>
<DIV><FONT color=#000000 size=2>interface used with DHCPC that connects to RR,
or LOOPBACK_INTERFACE= "lo". It uses </FONT></DIV>
<DIV><FONT color=#000000 size=2>the following syntax:</FONT></DIV>
<DIV><FONT color=#000000 size=2></FONT> </DIV>
<DIV><FONT color=#000000 size=2>ipfwadm -O -a accept -W $LOOPBACK_INTERFACE
.</FONT></DIV>
<DIV><FONT color=#000000 size=2></FONT> </DIV>
<DIV><FONT color=#000000 size=2>Comment for this line says "Unlimited
trafic on loopback interface."</FONT></DIV>
<DIV><FONT color=#000000 size=2></FONT> </DIV>
<DIV><FONT color=#000000 size=2>I understand this to say accept any packets from
the loopback interface destined for anywhere.</FONT></DIV>
<DIV><FONT color=#000000 size=2></FONT> </DIV>
<DIV><FONT size=2>When I list the resulting rule :ipfwadm -O -l , I
get :</FONT></DIV>
<DIV><FONT size=2></FONT> </DIV>
<DIV><FONT size=2>acc all anywhere anywhere.</FONT></DIV>
<DIV><FONT size=2></FONT> </DIV>
<DIV><FONT size=2>I think the problem is in the use of the -W parameter.
This is supposed to designate the name of an</FONT></DIV>
<DIV><FONT size=2>interface, but it is not able to evaluate lo so it defaults to
anywhere. The gateway box knows about </FONT></DIV>
<DIV><FONT size=2>lo,eth0,eth1 according to ifconfig, and they are active. So
any ideas as to what -W name is supposed to</FONT></DIV>
<DIV><FONT size=2>evaluate to? IP Address? I can edit the script to do so , but
how do you think it is supposed to work?</FONT></DIV>
<DIV><FONT size=2></FONT> </DIV>
<DIV><FONT size=2>Thanks Mark Robinson</FONT></DIV></BODY></HTML>