Date: Wed, 9 Oct 2002 13:41:26 -0700 From: "Crist J. Clark" <crist.clark@attbi.com> To: Danny.Carroll@mail.ing.nl Cc: ipfw@FreeBSD.ORG Subject: Re: Question about to/from matching. Message-ID: <20021009204126.GB64287@blossom.cjclark.org> In-Reply-To: <C6304883FB11E347AD4958D3F14EC00AB1DB12@ing.com> References: <C6304883FB11E347AD4958D3F14EC00AB1DB12@ing.com>
next in thread | previous in thread | raw e-mail | index | archive | help
On Fri, Oct 04, 2002 at 01:14:00PM +0200, Danny.Carroll@mail.ing.nl wrote:
> I have not got my copy of "Internetworking with TCP/IP Vol. x" with me (someone borrowed it indefinatly) so forgive this rather basic question.
>
> I have a rule, very early in my ruleset that says:
> deny log ip from any to 10.0.0.0/8 via xl0
>
> but my gateway (and default route) is 10.0.0.100
>
> Now, it's working the way I want it to... In that it sends outside stuff to 10.0.0.100 and I can't telnet directly to the gateway. But I am curious why this rule does not get inforced.
It does get enforced. You said you cannot telnet to 10.0.0.100.
> What does a TCP packet look like when it's being sent *to* a remote destination, but via a gateway. Does the ip stack translate 10.0.0.100 to an ethernet address and pass it on that way?
Yes. The gateway's IP address doesn't appear in the IP packet. Have a
look at the packet. Use tcpdump(8) with '-X' and look diagram of the
data fields in an IP datagram.
--
Crist J. Clark | cjclark@alum.mit.edu
| cjclark@jhu.edu
http://people.freebsd.org/~cjc/ | cjc@freebsd.org
To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-ipfw" in the body of the message
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20021009204126.GB64287>