From owner-freebsd-questions Thu Jan 3 14:42:19 2002 Delivered-To: freebsd-questions@freebsd.org Received: from falcon.prod.itd.earthlink.net (falcon.mail.pas.earthlink.net [207.217.120.74]) by hub.freebsd.org (Postfix) with ESMTP id 2372A37B41B for ; Thu, 3 Jan 2002 14:42:16 -0800 (PST) Received: from user-33qtk3u.dialup.mindspring.com ([199.174.208.126] helo=gohan.cjclark.org) by falcon.prod.itd.earthlink.net with esmtp (Exim 3.33 #1) id 16MGYo-00007w-00; Thu, 03 Jan 2002 14:42:09 -0800 Received: (from cjc@localhost) by gohan.cjclark.org (8.11.6/8.11.1) id g03Mfi601778; Thu, 3 Jan 2002 14:41:44 -0800 (PST) (envelope-from cjc) Date: Thu, 3 Jan 2002 14:41:41 -0800 From: "Crist J. Clark" To: Chris Appleton Cc: freebsd-questions@FreeBSD.ORG Subject: Re: ipfw.rules Message-ID: <20020103144141.E236@gohan.cjclark.org> Reply-To: cjclark@alum.mit.edu References: <20020103153847.12460.qmail@web14808.mail.yahoo.com> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline User-Agent: Mutt/1.2.5i In-Reply-To: <20020103153847.12460.qmail@web14808.mail.yahoo.com>; from appleton_chris@yahoo.com on Thu, Jan 03, 2002 at 07:38:47AM -0800 X-URL: http://people.freebsd.org/~cjc/ Sender: owner-freebsd-questions@FreeBSD.ORG Precedence: bulk List-ID: List-Archive: (Web Archive) List-Help: (List Instructions) List-Subscribe: List-Unsubscribe: X-Loop: FreeBSD.ORG On Thu, Jan 03, 2002 at 07:38:47AM -0800, Chris Appleton wrote: > I'm struggling getting a simple ruleset working in a 4.4release bridge. > > If I run just > allow ip from any to any #things run well (of course). > > But if I build: > allow tcp from any to any established > allow ip from a.b.c.d to any > deny ip from any to any #http requests slow dramatically > > am I missing something, like some 0.0.0.0 udp trick to allow arp > packets (i've glaced but can't find the article anymore). Is that > something I need to do. ARP is not UDP. ARPs will go through your bridge just fine. > What it looks like is something between allowing any TCP and allowing > any IP that I'm not doing. But your problem probably is UDP related. Your delays may be due to the fact you are blocking DNS queries. -- "It's always funny until someone gets hurt. Then it's hilarious." Crist J. Clark | cjclark@alum.mit.edu | cjclark@jhu.edu http://people.freebsd.org/~cjc/ | cjc@freebsd.org To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-questions" in the body of the message