Date: Sun, 14 Sep 2014 12:36:43 +0200 From: Willem Jan Withagen <wjw@digiware.nl> To: Freddie Cash <fjwcash@gmail.com>, bycn82 <bycn82@gmail.com> Cc: freebsd-ipfw@freebsd.org Subject: Re: IPFW rule sets and automatic rule numbering Message-ID: <54156FBB.1030907@digiware.nl> In-Reply-To: <CAOjFWZ749EazFz1prFRfidp9bqmqO%2B=%2BXFsu7mVtE%2Bnq2CxwKw@mail.gmail.com> References: <CAOjFWZ4rx4FAc4AoPw3d=cSg4-z_QOWEF=phkT2PuzfUjn0y5A@mail.gmail.com> <CAOjFWZ6i1%2BgCZ9jMnBNEGqL7airdxN3d=B0__Z_Zj1gGG4APKg@mail.gmail.com> <541469D4.6070107@gmail.com> <CAOjFWZ749EazFz1prFRfidp9bqmqO%2B=%2BXFsu7mVtE%2Bnq2CxwKw@mail.gmail.com>
next in thread | previous in thread | raw e-mail | index | archive | help
On 13-9-2014 21:51, Freddie Cash wrote: > You can replicate it using 3 rules, loaded into two sets: > > ipfw set disable 1 > ipfw add allow ip from any to any > ipfw add 65524 allow ip from any to any > ipfw add allow ip from any to any > ipfw set swap 1 0 > > Run that two or 3 times. Every rule will be numbered 65534 after the 2nd or > 3rd run. > > I expected it to be numbered 10, 65524, 65534 after every run. > > However, after reading the man page a few more times and thinking about it > a little more, it makes sense that the numbering is global across all sets, > as you can have multiple sets enabled simultaneously. > > It just doesn't mesh with my desire to use auto numbering. I'm in the midst > of manually numbering all my rules now. :) > _______________________________________________ > freebsd-ipfw@freebsd.org mailing list > http://lists.freebsd.org/mailman/listinfo/freebsd-ipfw > To unsubscribe, send any mail to "freebsd-ipfw-unsubscribe@freebsd.org" > This is easily circumvented by making shure that the first rule is ipfw add 10 ..... like: ipfw add count ip4 from any to any via vlan126 (vlan126 is my outside connection) And then you are home free. I actually use this to also separate diffent types of block by injecting: ipfw add <blocknumber> count ip from any to any like: 03000 713812041 425643462848 count ip from any to any 03010 0 0 deny ip6 from fc00::/7 to any via vlan126 And the 3000 block contains all antispoofing and likes. --WjW
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?54156FBB.1030907>