From owner-freebsd-questions@FreeBSD.ORG Mon Sep 13 04:32:07 2010 Return-Path: Delivered-To: freebsd-questions@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34]) by hub.freebsd.org (Postfix) with ESMTP id 8BDD4106566B for ; Mon, 13 Sep 2010 04:32:07 +0000 (UTC) (envelope-from sudakov@sibptus.tomsk.ru) Received: from relay2.tomsk.ru (relay2.tomsk.ru [212.73.124.8]) by mx1.freebsd.org (Postfix) with ESMTP id D8ED78FC16 for ; Mon, 13 Sep 2010 04:32:06 +0000 (UTC) X-Virus-Scanned: by clamd daemon 0.93.1 for FreeBSD at relay2.tomsk.ru Received: from admin.sibptus.tomsk.ru (account sudakov@sibptus.tomsk.ru [212.73.125.240] verified) by relay2.tomsk.ru (CommuniGate Pro SMTP 5.1.13) with ESMTPSA id 14345012 for freebsd-questions@freebsd.org; Mon, 13 Sep 2010 11:32:04 +0700 Received: from admin.sibptus.tomsk.ru (sudakov@localhost [127.0.0.1]) by admin.sibptus.tomsk.ru (8.14.3/8.14.3) with ESMTP id o8D4W462011726 for ; Mon, 13 Sep 2010 11:32:04 +0700 (OMSST) (envelope-from sudakov@sibptus.tomsk.ru) Received: (from sudakov@localhost) by admin.sibptus.tomsk.ru (8.14.3/8.14.3/Submit) id o8D4W325011725 for freebsd-questions@freebsd.org; Mon, 13 Sep 2010 11:32:03 +0700 (OMSST) (envelope-from sudakov@sibptus.tomsk.ru) X-Authentication-Warning: admin.sibptus.tomsk.ru: sudakov set sender to sudakov@sibptus.tomsk.ru using -f Date: Mon, 13 Sep 2010 11:32:03 +0700 From: Victor Sudakov To: freebsd-questions@freebsd.org Message-ID: <20100913043203.GB11527@admin.sibptus.tomsk.ru> Mail-Followup-To: Victor Sudakov , freebsd-questions@freebsd.org References: <20100822052550.GA42346@admin.sibptus.tomsk.ru> <20100907090012.GA48608@admin.sibptus.tomsk.ru> <4C8616F0.5010401@gmx.com> <20100907110033.GA51618@admin.sibptus.tomsk.ru> <4C864145.80805@gmx.com> <20100907145223.GA55660@admin.sibptus.tomsk.ru> <4C8754CD.6030003@gmx.com> <20100910125534.GA50527@admin.sibptus.tomsk.ru> <4c8b3849.mx6rDwHZtDT6N5YR%perryh@pluto.rain.com> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <4c8b3849.mx6rDwHZtDT6N5YR%perryh@pluto.rain.com> User-Agent: Mutt/1.4.2.3i Organization: AO "Svyaztransneft", SibPTUS X-PGP-Key: http://vas.tomsk.ru/vas.asc Subject: Re: ipfw fwd and ipfw allow X-BeenThere: freebsd-questions@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: User questions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 13 Sep 2010 04:32:07 -0000 perryh@pluto.rain.com wrote: > > > ... the 'fwd ... keep-state' statement does create a useful > > dynamic rule. It contradicts the ipfw(8) man page but works ... > > Hopefully someone who understands all this will submit a patch > for the man page :) The man page says that the "Dynamic rules will be checked at the first check-state, keep-state or limit occurrence, and the action performed upon a match will be the same as in the parent rule." It suggests that if the parent rule is a 'fwd' rule, the corresponding dynamic rule is also a 'fwd' rule, which would be no use (who needs a reflexive 'fwd' rule?). However, in reality a parent 'fwd' rule seems to create an 'allow' dynamic rule, which is useful but confusing. Where exactly is this place in the ipfw code? -- Victor Sudakov, VAS4-RIPE, VAS47-RIPN sip:sudakov@sibptus.tomsk.ru