Date: Thu, 14 Oct 2004 05:32:22 +0200 From: Christian Hiris <4711@chello.at> To: freebsd-current@freebsd.org Subject: Re: Ipfw rules ? Message-ID: <200410140532.58548.4711@chello.at> In-Reply-To: <217202CB5FF8AE439E263CE3D48ECB50757DC3@honda.int.hansa.lt> References: <217202CB5FF8AE439E263CE3D48ECB50757DC3@honda.int.hansa.lt>
next in thread | previous in thread | raw e-mail | index | archive | help
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 On Wednesday 13 October 2004 11:38, Putinas Piliponis wrote: > Hello, > I have a ipfw rule: > add 40000 count ip from 10.127.0.2 to any MAC any 00:50:56:e4:79:6c in > via lnc0 > But ipfw shows it like: > 40000 0 0 count ip from 10.127.0.2 MAC any 00:50:56:e4:79:6c any > in via lnc0 > > Is ipfw really correctly showing the rule ? AFAIK you need to split your rule into an "ip-rule" and a "MAC-rule". You need this, because the ip address-part only matches layer3 packets and the MAC-part only matches layer2 packets. At etherdemux/ether_output_frame ipfw doesn't know about the ip-address and at ip_input/ip_output ipfw doesn't know about the MAC-address. So your rule will never match. man 8 ipfw --> search for "packet flow" Cheers, ch - -- Christian Hiris <4711@chello.at> | OpenPGP KeyID 0x3BCA53BE OpenPGP-Key at hkp://wwwkeys.eu.pgp.net and http://pgp.mit.edu -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.6 (FreeBSD) iD8DBQFBbfNq09WjGjvKU74RAoSDAJ9oQz4RgkKLZaVQowlLXVck0bnhsgCeIjXC qG3gOOFhmW0wiKHE/GdFhEo= =y0My -----END PGP SIGNATURE-----
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?200410140532.58548.4711>