Date: Sat, 13 Aug 2005 00:59:54 +0200 From: Max Laier <max@love2party.net> To: Jeremie Le Hen <jeremie@le-hen.org> Cc: Andrew Thompson <thompsa@freebsd.org>, freebsd-pf@freebsd.org Subject: Re: Bridge and PF Message-ID: <200508130100.09827.max@love2party.net> In-Reply-To: <20050812224055.GF45385@obiwan.tataz.chchile.org> References: <1123858936.22864.252.camel@torgau.office.netline.net.uk> <200508121751.27737.max@love2party.net> <20050812224055.GF45385@obiwan.tataz.chchile.org>
next in thread | previous in thread | raw e-mail | index | archive | help
--nextPart1163691.tYQ7fp2MzY
Content-Type: text/plain;
charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable
Content-Disposition: inline
On Saturday 13 August 2005 00:40, Jeremie Le Hen wrote:
> Hi,
>
> > This is not true. As Scott suggested try if_bridge in 6.0 which has bo=
th
> > IPv6
> > and full pf support. Additionally, pf is supported by the old bridge
> > just use the same settings you would use for ipf. The old bridge does
> > not allow for stateful filtering however. The same is true for ipf and
> > ipfw with the old bridge code.
>
> Does if_bridge generally support PF_HOOKS (thus one can use ipfw),
> or is it strictly bound to pf ?
As per if_bridge(4):
When filtering is enabled, bridged packets will pass through the filter
inbound on the originating interface, on the bridge interface and out-
bound on the appropriate interfaces. Either stage can be disabled, th=
is
behaviour can be controlled using sysctl(8):
net.link.bridge.pfil_member Set to 1 to enable filtering on the incom=
ing
and outgoing member interfaces, set to 0 =
to
disable it.
net.link.bridge.pfil_bridge Set to 1 to enable filtering on the bridge
interface, set to 0 to disable it.
net.link.bridge.ipfw Set to 1 to enable layer2 filtering with
ipfirewall(4), set to 0 to disable it. T=
his
needs to be enabled for dummynet(4) suppo=
rt.
When ipfw is enabled, pfil_bridge and
pfil_member will be disabled so that IPFW=
is
not run twice; these can be re-enabled if
desired.
=2D-=20
/"\ Best regards, | mlaier@freebsd.org
\ / Max Laier | ICQ #67774661
X http://pf4freebsd.love2party.net/ | mlaier@EFnet
/ \ ASCII Ribbon Campaign | Against HTML Mail and News
--nextPart1163691.tYQ7fp2MzY
Content-Type: application/pgp-signature
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.2 (FreeBSD)
iD8DBQBC/Sn5XyyEoT62BG0RAp8sAJwITsFMqqH4YymHzncwCSg9zssaKACfbsAk
Sw38Tj6lnKayxUcr9ukuXrk=
=f9My
-----END PGP SIGNATURE-----
--nextPart1163691.tYQ7fp2MzY--
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?200508130100.09827.max>