From owner-freebsd-net@FreeBSD.ORG Sat Aug 2 21:45:22 2003 Return-Path: Delivered-To: freebsd-net@freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id AF6B337B404 for ; Sat, 2 Aug 2003 21:45:22 -0700 (PDT) Received: from mx1.evo6.net (mx1.evo6.net [80.76.194.10]) by mx1.FreeBSD.org (Postfix) with SMTP id 14BF143FAF for ; Sat, 2 Aug 2003 21:45:21 -0700 (PDT) (envelope-from andy@mx1.evo6.net) Received: (qmail 796 invoked by uid 1001); 3 Aug 2003 04:45:19 -0000 Date: Sun, 3 Aug 2003 05:45:19 +0100 From: Andy Gilligan To: Mike Wade Message-ID: <20030803044519.GA32629@vega.evo6.net> References: <20030802203114.J4501@net-ninja.dyndns.org> <20030803020257.GA79533@vega.evo6.net> <20030802223846.V4501@net-ninja.dyndns.org> Mime-Version: 1.0 Content-Type: text/plain; charset=iso-8859-1 Content-Disposition: inline In-Reply-To: <20030802223846.V4501@net-ninja.dyndns.org> User-Agent: Mutt/1.4.1i X-Spam-Status: No, hits=-5.0 required=5.0 tests=EMAIL_ATTRIBUTION,IN_REP_TO,QUOTED_EMAIL_TEXT,REFERENCES, REPLY_WITH_QUOTES,USER_AGENT_MUTT version=2.55-evo6.net X-Spam-Level: X-Spam-Checker-Version: SpamAssassin 2.55-evo6.net (1.174.2.19-2003-05-19-exp) cc: freebsd-net@freebsd.org Subject: Re: ipfw2 mac address matching weirdness? X-BeenThere: freebsd-net@freebsd.org X-Mailman-Version: 2.1.1 Precedence: list List-Id: Networking and TCP/IP with FreeBSD List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 03 Aug 2003 04:45:23 -0000 On Sun, Aug 03, 2003 at 03:39:24AM BST, Mike Wade wrote: > On Sun, 3 Aug 2003, Andy Gilligan wrote: > > > On Sun, Aug 03, 2003 at 01:31:23AM BST, Mike Wade wrote: > > > I'm running FreeBSD 4.8 RELEASE w/ IPFW2 support enabled. I'm running > > > into some weirdness with the mac address matching feature or perhaps it's > > > my lack of understanding how it interacts with other rules. :) > > > > > > My goal is to transparently redirect everything except a few select MAC > > > addresses but it doesn't appear to work properly. For example: > > > > > > net-ninja# ipfw list > > > 00001 skipto 65535 ip from any to any MAC any any in via sis0 > > > 00002 fwd 127.0.0.1,8080 tcp from any to any dst-port 80 in via sis0 > > > 65535 allow ip from any to any > > > > > > This should allow every MAC address to bypass the transparent redirect but > > > it doesn't. If I change rule #1 to: > > > > > > 00001 skipto 65535 ip from any to any in via sis0 > > > > > > Things work as advertised. Any ideas? > > > > Try: > > > > sysctl net.link.ether.ipfw=1 > > Hmm, it was already set: > > net-ninja# sysctl net.link.ether.ipfw > net.link.ether.ipfw: 1 The best advice I can give at the moment is to read the "PACKET FLOW" section in ipfw(8). A brief read over it suggests that it *may* not be possible to do what you ask, due to the rules being parsed twice. (in your case) The first pass is done from ether_demux(), and this will only match the first rule - it won't match tcp or dst-port 80, etc. The second pass will come from ip_input(), which will only match the second rule, as it doesn't know anything about MAC addresses. I could be missing something (it is 4am), so hopefully somebody will step in and tell me I'm wrong :) Sorry I couldn't be of more help. Best regards, -Andy