Date: Mon, 18 Jul 2005 02:09:00 -0700 From: Luigi Rizzo <rizzo@icir.org> To: freebsd-ipfw@freebsd.org Subject: Re: "or" blocks in IPFW2 Message-ID: <20050718020900.D13026@xorpc.icir.org> In-Reply-To: <200507131557.j6DFvrSY024295@lurza.secnetix.de>; from olli@lurza.secnetix.de on Wed, Jul 13, 2005 at 05:57:53PM %2B0200 References: <200507131557.j6DFvrSY024295@lurza.secnetix.de>
next in thread | previous in thread | raw e-mail | index | archive | help
On Wed, Jul 13, 2005 at 05:57:53PM +0200, Oliver Fromme wrote:
> Hi,
...
> # ipfw add allow tcp from any to any \{ in recv fxp0 or out xmit fxp0 \}
> 04400 allow tcp from any to any in { recv fxp0 or out } xmit fxp0
surely the parser is not very robust and should complain :)
This said, the 'or' is a conjunction of individual options,
and 'in' is one option and 'recv fxp0' is another one.
if you need something different you probably have to write separate rules.
cheers
luigi
> Of course, now the rule does something completely different
> which doesn't even make any sense. Most confusingly, I
> don't get an error message or even a warning from the parser.
>
> Is this a bug in ipfw, or a bug in the manpage, or do I
> just misunderstand things? Do I have to write two separate
> rules?
>
> Thanks in advance!
>
> Best regards
> Oliver
>
> --
> Oliver Fromme, secnetix GmbH & Co KG, Oettingenstr. 2, 80538 München
> Any opinions expressed in this message may be personal to the author
> and may not necessarily reflect the opinions of secnetix in any way.
>
> "Unix gives you just enough rope to hang yourself --
> and then a couple of more feet, just to be sure."
> -- Eric Allman
> _______________________________________________
> freebsd-ipfw@freebsd.org mailing list
> http://lists.freebsd.org/mailman/listinfo/freebsd-ipfw
> To unsubscribe, send any mail to "freebsd-ipfw-unsubscribe@freebsd.org"
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20050718020900.D13026>