Date: 27 Nov 2002 09:20:46 -0500 From: Dan Pelleg <daniel+bsd@pelleg.org> To: freebsd-ipfw@freebsd.org Subject: IPFW2 keepalives only work in one direction? Message-ID: <u2sof8b3xhd.fsf@gs166.sp.cs.cmu.edu>
next in thread | raw e-mail | index | archive | help
I'm trying to track down a problem with IPFW2 where stateful connections
time out. net.inet.ip.fw.dyn_keepalive is set to 1. This a host that can
SSH out and also accepts incoming SSH connection. The relevant rules are:
allow tcp from ${friendlynet} to me dst-port 22 setup
allow tcp from me to any keep-state
What I'm noticing is that:
- if I ssh out, IPFW2's keepalives will keep the connection alive (the
timeout counter on it will jump up if the connection is left idle)
- if I ssh *in*, the connection will be made, but will time out if left idle.
Now, if the following two rules are changed to:
allow tcp from ${friendlynet} to me dst-port 22 setup keep-state
allow tcp from me to any keep-state
then neither type of connection times out.
What's going on? I understand that in the first configuration the stateful
rules are associated with the second rule (since they're generated by the
reply packet). But still - the dynamic rule is installed, so ipfw should
keep it alive just the same, no?
This is -STABLE as of Nov. 16
--
Dan Pelleg
To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-ipfw" in the body of the message
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?u2sof8b3xhd.fsf>