IPFilter and ping

[Mohammad Rizal Othman <rizal@mimos.my>]

I hope it is ok to ask this question here.

I've configured an OpenBSD based firewall using IPFilter.  So far
everything works fine.  Today, I tried to add another rule just to play
around with it.  I tried to ping a machine behind the firewall, but
received nothing back.  For your information, the machines behind the
firewall all have registered IPs.  The rule that I used was something
like

pass in on fxp0 proto icmp from host-outside-fw/32 to host-behind-fw/32

Is it possible at all to do this?

Another thing is I cannot ping beyond the firewall from a host behind
the firewall.  I have this rules (from firewall.1, I think)

pass out log on ep0 proto icmp all keep state
pass out log on ep1 proto icmp all keep state

but still doesn't work.  Is this a shortcoming of IPFilter?

Hope to get some helps.


-- 
-------------------------------------------------------------------------------
Mohd. Rizal Othman           |  Tel: 603-9665000 x 4010
Systems Engineer             |  my $os =~ s/Windows/UNIX/:
MIMOS BHD                    |  Get out of the Windows, get into the
real world
-------------------------------------------------------------------------------