From owner-freebsd-current@FreeBSD.ORG Sat Nov 12 00:35:31 2005 Return-Path: X-Original-To: current@freebsd.org Delivered-To: freebsd-current@FreeBSD.ORG Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id 6119216A41F for ; Sat, 12 Nov 2005 00:35:31 +0000 (GMT) (envelope-from sean@mcneil.com) Received: from mail.mcneil.com (mcneil.com [24.199.45.54]) by mx1.FreeBSD.org (Postfix) with ESMTP id 23E0343D46 for ; Sat, 12 Nov 2005 00:35:31 +0000 (GMT) (envelope-from sean@mcneil.com) Received: from localhost (localhost.mcneil.com [127.0.0.1]) by mail.mcneil.com (Postfix) with ESMTP id D4B23F24BB for ; Fri, 11 Nov 2005 16:35:30 -0800 (PST) Received: from mail.mcneil.com ([127.0.0.1]) by localhost (triton.mcneil.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 00818-07 for ; Fri, 11 Nov 2005 16:35:30 -0800 (PST) Received: from mcneil.com (mcneil.com [24.199.45.54]) by mail.mcneil.com (Postfix) with ESMTP id 5BB12F2453 for ; Fri, 11 Nov 2005 16:35:30 -0800 (PST) From: Sean McNeil To: current@freebsd.org Content-Type: text/plain Date: Fri, 11 Nov 2005 16:35:30 -0800 Message-Id: <1131755730.6959.7.camel@triton.mcneil.com> Mime-Version: 1.0 X-Mailer: Evolution 2.4.1 FreeBSD GNOME Team Port Content-Transfer-Encoding: 7bit X-Virus-Scanned: by amavisd-new at mcneil.com X-Mailman-Approved-At: Sat, 12 Nov 2005 03:05:13 +0000 Cc: Subject: verrevpath failure from within my own box X-BeenThere: freebsd-current@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Discussions about the use of FreeBSD-current List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 12 Nov 2005 00:35:31 -0000 I was wondering... is there is any valid time when FreeBSD would generate improper revpaths? My setup is on a 6-STABLE system with the patch from suz to ip_fw2.c that fixes a revpath problem. It is setup as dc0 - external nic with natd and ipfw2 sk0 - internal nic The rule is 00300 28 2177 deny ip from any to any not verrevpath in via dc0 as you can see, there are some packets that were denied. I can reproduce this with nautilus by simply browsing network:///. I've even unplugged the cables from the nics to make sure it wasn't some bad response to a network query. It is not. They are being generated within my box. Sean