Date: Tue, 9 Dec 2003 21:51:21 -0800 From: "Crist J. Clark" <cristjc@comcast.net> To: fbsd_user <fbsd_user@a1poweruser.com> Cc: renaud@waldura.com Subject: Re: FreeBSD IPFW/IPFILTER & sysctl MIB's Message-ID: <20031210055121.GC84766@blossom.cjclark.org> In-Reply-To: <MIEPLLIBMLEEABPDBIEGAENAEPAA.fbsd_user@a1poweruser.com> References: <MIEPLLIBMLEEABPDBIEGAENAEPAA.fbsd_user@a1poweruser.com>
next in thread | previous in thread | raw e-mail | index | archive | help
On Sun, Dec 07, 2003 at 11:49:42AM -0500, fbsd_user wrote:
[snip]
How's it goin', fbsd_user? Been a while.
> The question is, who get access to the packets first, these MIB's
> or the firewall?
There is no simple answer to this. The MIB values affect behaviors
within the kernel. The important parts of ipfw(8) and ipf(8) are code
inside of the kernel. The some of the behavior of ipfw(8) and ipf(8)
themselves are controlled by sysctl(8) knobs,
net.inet.ip.fw.enable
net.inet.ip.fw.one_pass
net.inet.ip.fw.debug
net.inet.ip.fw.verbose
...
net.inet.ipf.fr_flags
net.inet.ipf.fr_pass
net.inet.ipf.fr_active
net.inet.ipf.fr_tcpidletimeout
...
Whether a specific entry in the sysctl(8) MIB has an effect felt
before a packet gets to ipfw(8) or ipf(8) processing depends on that
specific entry.
And just because the feature enabled by the sysctl(8) knob occurs
after firewall processing does not mean it is useless. Packets that
are allowed through the firewall still will be affected by their
settings. For example, you set net.inet.tcp.drop_synfin and have a
rule like,
02000 pass tcp from any to ${smtpsrv} 25
For your mail server. You do not need to add an explicit drop rule for
SYN+FIN packets in your firewall rules (or more likely, you are
protected if you forget such a rule).
--
Crist J. Clark | cjclark@alum.mit.edu
| cjclark@jhu.edu
http://people.freebsd.org/~cjc/ | cjc@freebsd.org
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20031210055121.GC84766>