From owner-freebsd-ipfw@FreeBSD.ORG Sun Sep 14 10:37:17 2014 Return-Path: Delivered-To: freebsd-ipfw@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:1900:2254:206a::19:1]) (using TLSv1 with cipher ADH-AES256-SHA (256/256 bits)) (No client certificate requested) by hub.freebsd.org (Postfix) with ESMTPS id 2DC74DC3 for ; Sun, 14 Sep 2014 10:37:17 +0000 (UTC) Received: from smtp.digiware.nl (unknown [IPv6:2001:4cb8:90:ffff::3]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (Client did not present a certificate) by mx1.freebsd.org (Postfix) with ESMTPS id DDC4E67D for ; Sun, 14 Sep 2014 10:37:16 +0000 (UTC) Received: from rack1.digiware.nl (unknown [127.0.0.1]) by smtp.digiware.nl (Postfix) with ESMTP id 657BC153448; Sun, 14 Sep 2014 12:37:05 +0200 (CEST) X-Virus-Scanned: amavisd-new at digiware.nl Received: from smtp.digiware.nl ([127.0.0.1]) by rack1.digiware.nl (rack1.digiware.nl [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id MTiL1bMN8ftB; Sun, 14 Sep 2014 12:36:42 +0200 (CEST) Received: from [192.168.10.9] (vaio [192.168.10.9]) (using TLSv1 with cipher ECDHE-RSA-AES128-SHA (128/128 bits)) (No client certificate requested) by smtp.digiware.nl (Postfix) with ESMTPSA id E6134153A8C; Sun, 14 Sep 2014 12:36:42 +0200 (CEST) Message-ID: <54156FBB.1030907@digiware.nl> Date: Sun, 14 Sep 2014 12:36:43 +0200 From: Willem Jan Withagen User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:24.0) Gecko/20100101 Thunderbird/24.6.0 MIME-Version: 1.0 To: Freddie Cash , bycn82 Subject: Re: IPFW rule sets and automatic rule numbering References: <541469D4.6070107@gmail.com> In-Reply-To: Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: 7bit Cc: freebsd-ipfw@freebsd.org X-BeenThere: freebsd-ipfw@freebsd.org X-Mailman-Version: 2.1.18-1 Precedence: list List-Id: IPFW Technical Discussions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 14 Sep 2014 10:37:17 -0000 On 13-9-2014 21:51, Freddie Cash wrote: > You can replicate it using 3 rules, loaded into two sets: > > ipfw set disable 1 > ipfw add allow ip from any to any > ipfw add 65524 allow ip from any to any > ipfw add allow ip from any to any > ipfw set swap 1 0 > > Run that two or 3 times. Every rule will be numbered 65534 after the 2nd or > 3rd run. > > I expected it to be numbered 10, 65524, 65534 after every run. > > However, after reading the man page a few more times and thinking about it > a little more, it makes sense that the numbering is global across all sets, > as you can have multiple sets enabled simultaneously. > > It just doesn't mesh with my desire to use auto numbering. I'm in the midst > of manually numbering all my rules now. :) > _______________________________________________ > freebsd-ipfw@freebsd.org mailing list > http://lists.freebsd.org/mailman/listinfo/freebsd-ipfw > To unsubscribe, send any mail to "freebsd-ipfw-unsubscribe@freebsd.org" > This is easily circumvented by making shure that the first rule is ipfw add 10 ..... like: ipfw add count ip4 from any to any via vlan126 (vlan126 is my outside connection) And then you are home free. I actually use this to also separate diffent types of block by injecting: ipfw add count ip from any to any like: 03000 713812041 425643462848 count ip from any to any 03010 0 0 deny ip6 from fc00::/7 to any via vlan126 And the 3000 block contains all antispoofing and likes. --WjW