From owner-freebsd-ipfw@FreeBSD.ORG  Thu Mar 19 19:29:06 2009
Return-Path: <owner-freebsd-ipfw@FreeBSD.ORG>
Delivered-To: freebsd-ipfw@freebsd.org
Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34])
	by hub.freebsd.org (Postfix) with ESMTP id 9CF671065672
	for <freebsd-ipfw@freebsd.org>; Thu, 19 Mar 2009 19:29:06 +0000 (UTC)
	(envelope-from dima_bsd@inbox.lv)
Received: from smtp4.apollo.lv (smtp4.apollo.lv [80.232.168.199])
	by mx1.freebsd.org (Postfix) with ESMTP id 227128FC0C
	for <freebsd-ipfw@freebsd.org>; Thu, 19 Mar 2009 19:29:05 +0000 (UTC)
	(envelope-from dima_bsd@inbox.lv)
X-Junk-Score: 0 []
X-Cloudmark-Score: 0 []
X-Virus-Scanned: by cgpav
Received: from [81.198.144.211] ([81.198.144.211] verified)
	by smtp4.apollo.lv (CommuniGate Pro SMTP 5.2.3)
	with ESMTP id 306895827; Thu, 19 Mar 2009 21:29:04 +0200
From: Dmitriy Demidov <dima_bsd@inbox.lv>
To: freebsd-ipfw@freebsd.org
Date: Thu, 19 Mar 2009 21:29:03 +0200
User-Agent: KMail/1.9.10
References: <200903181033.n2IAXieV038438@lurza.secnetix.de>
In-Reply-To: <200903181033.n2IAXieV038438@lurza.secnetix.de>
MIME-Version: 1.0
Content-Type: text/plain;
  charset="iso-8859-1"
Content-Transfer-Encoding: 7bit
Content-Disposition: inline
Message-Id: <200903192129.03360.dima_bsd@inbox.lv>
Cc: Oliver Fromme <olli@lurza.secnetix.de>
Subject: Re: keep-state rules inadequately handles big UDP
	?packets?or?fragmented IP packets?
X-BeenThere: freebsd-ipfw@freebsd.org
X-Mailman-Version: 2.1.5
Precedence: list
List-Id: IPFW Technical Discussions <freebsd-ipfw.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-ipfw>,
	<mailto:freebsd-ipfw-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-ipfw>
List-Post: <mailto:freebsd-ipfw@freebsd.org>
List-Help: <mailto:freebsd-ipfw-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-ipfw>,
	<mailto:freebsd-ipfw-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Thu, 19 Mar 2009 19:29:07 -0000

On Wednesday 18 March 2009, Oliver Fromme wrote:
> I'm just curious ...  Is it really worth the effort to add
> fragment reassembly to IPFW?  What advantage does it have?
>
> It would be much easier to simply pass all fragments with
> offset > 1, and drop all fragments with offset 0 that are
> smaller than a certain reasonable minimum length.  What
> would be the problem with this approach?
>
> Best regards
>    Oliver

Please wait... If I got it right (and dont missing something) then this rule:
ipfw add allow ip from any to me frag
have dissadvantage - I'm unabled to filter data by UDP/TCP ports. All IP 
packets is just passing through firewall to me. No UDP/TCP filtering here?