Re: problem of nocat + FreeBSD-4.8-ipfw2+timestamp-20030616.patch

On November 9, 2004 02:08 am, amon wrote:
> hi list,
> yes, i did a lot of searchs from this nocat list and google.
> some many pepole say: he can install NoCat in FreeBSD!
> but unfortunately, i made a mess.
>
> i also used a patch from http://www.pogozone.net/projects/nocat/
> below is my install process:
>     Kernel built with options for ipfirewall, ipfirewall_verbose,
>     ipfirewall_verbose_limit=100, ipfirewall_default_to_accept, ipdivert,
>     ipfirewall_forward and dummynet.
> download NoCatAuth-0.82.tar.gz and NoCatAuth-0.82+IPFW2-20030714.patch
>     in FreeBSD4.8realese
> # tar -zxf NoCatAuth-0.82.tar.gz
> # cd NoCatAuth-0.82
> # mv ../NoCatAuth-0.82+IPFW2-20030714.patch ./
> # patch -p0 < NoCatAuth-0.82+IPFW2-20030714.patch
> # make gateway
>
> and edit nocat.conf for my need(run bridge mode).
> for example:
>     AuthServiceAddr the_other_one
>     AuthServiceURL  https://$AuthServiceAddr/
>     ExternalDevice  fxp0
>     InternalDevice  bge0
>     LocalNetwork    220.228.XX.128/26
>     DNSAddr         168.95.X.X
>
> my network interface config is
>     fxp0: inet 220.228.XX.48 netmask 0xffffffc0 broadcast 220.228.XX.63
>     bge0: inet 220.228.XX.181 netmask 0xffffffc0 broadcast 220.228.XX.191
>
> then
> # /usr/local/gw/bin/gateway
> net.inet.ip.forwarding: 1 -> 1
> net.link.ether.ipfw: 1 -> 1
> 00100 allow log logamount 10 ip from any to any via fxp0
> 00200 allow log logamount 10 ip from any to any via lo0
> ipfw: invalid protocol ``layer2''
> 00300 allow log logamount 10 tcp from any to any 5280 in recv bge0
> 00400 allow log logamount 10 tcp from any to any 5280 out xmit bge0
> 00500 allow log logamount 10 tcp from any to any 22 in recv bge0
> 00600 allow log logamount 10 tcp from any to any 22 out xmit bge0
> 00700 allow log logamount 10 udp from any to 168.95.X.X 53 keep-state in
> recv bge0
> 00800 allow log logamount 10 tcp from any to 220.228.XX.46 80,443 in
> recv bge0
> 00900 fwd 220.228.XX.181,5280 log logamount 10 tcp from any to any
> 80,443 in recv bge0
> 01000 deny log logamount 10 ip from any to any in recv bge0
> ...
>
> i lost "layer2" ipfw rule,

From what I remember 4.8 is using ipfw1 instead of ipfw2.  The patches on 
pogozone are for ipfw2 as well (they _may_ work with ipfw1).  I believe that 
you can build ipfw2 on your machine by adding "IPFW2=true" to 
your /etc/make.conf and rebuilding world/kernel.

So, do you have ipfw2 or ipfw1?

From the 4.8 ipfw man page:

  Options
             The following options are not supported in ipfw1

             dst-ip, dst-port, layer2, mac, mac-type, src-ip, src-port.


Scott
> so i supposed all pocket must be captived by rule 900,
>      i will see the authserv's web page.
> but it was't work.
>
> Thanks in advance.
> amonrose
> _______________________________________________
> NoCat mailing list
> [email protected]
> http://lists.nocat.net/mailman/listinfo/nocat

-- 
Scott E. Campbell
Systems Administrator
Greater Victoria Public Library
Victoria, BC CANADA