From owner-freebsd-net@freebsd.org  Wed Dec 16 13:33:18 2015
Return-Path: <owner-freebsd-net@freebsd.org>
Delivered-To: freebsd-net@mailman.ysv.freebsd.org
Received: from mx1.freebsd.org (mx1.freebsd.org
 [IPv6:2001:1900:2254:206a::19:1])
 by mailman.ysv.freebsd.org (Postfix) with ESMTP id 42379A4933E
 for <freebsd-net@mailman.ysv.freebsd.org>;
 Wed, 16 Dec 2015 13:33:18 +0000 (UTC)
 (envelope-from smithi@nimnet.asn.au)
Received: from sola.nimnet.asn.au (paqi.nimnet.asn.au [115.70.110.159])
 (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits))
 (Client did not present a certificate)
 by mx1.freebsd.org (Postfix) with ESMTPS id 4F0D01A0C
 for <freebsd-net@freebsd.org>; Wed, 16 Dec 2015 13:33:15 +0000 (UTC)
 (envelope-from smithi@nimnet.asn.au)
Received: from localhost (localhost [127.0.0.1])
 by sola.nimnet.asn.au (8.14.2/8.14.2) with ESMTP id tBG5w0EX097808;
 Wed, 16 Dec 2015 16:58:02 +1100 (EST)
 (envelope-from smithi@nimnet.asn.au)
Date: Wed, 16 Dec 2015 16:58:00 +1100 (EST)
From: Ian Smith <smithi@nimnet.asn.au>
To: bcs <bimmer@field.hu>
cc: freebsd-net@freebsd.org
Subject: Re: arp response fails
In-Reply-To: <5670988B.5030905@field.hu>
Message-ID: <20151216163819.H95820@sola.nimnet.asn.au>
References: <5670988B.5030905@field.hu>
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
X-BeenThere: freebsd-net@freebsd.org
X-Mailman-Version: 2.1.20
Precedence: list
List-Id: Networking and TCP/IP with FreeBSD <freebsd-net.freebsd.org>
List-Unsubscribe: <https://lists.freebsd.org/mailman/options/freebsd-net>,
 <mailto:freebsd-net-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-net/>
List-Post: <mailto:freebsd-net@freebsd.org>
List-Help: <mailto:freebsd-net-request@freebsd.org?subject=help>
List-Subscribe: <https://lists.freebsd.org/mailman/listinfo/freebsd-net>,
 <mailto:freebsd-net-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Wed, 16 Dec 2015 13:33:18 -0000

On Tue, 15 Dec 2015 23:47:39 +0100, bcs wrote:
[..]
 > I use ipfw but "ipfw -q -f flush" didn't solve the issue. Here are my
[..]
 > /boot/loader.conf:
 > ipfw_load="YES"
 > net.inet.ip.fw.default_to_accept=1

ipfw(8):

     Tunables can be set in loader(8) prompt, loader.conf(5) or kenv(1) before
     ipfw module gets loaded.

     net.inet.ip.fw.default_to_accept: 0
             Defines ipfw last rule behavior. This value overrides options
             IPFW_DEFAULT_TO_(ACCEPT|DENY) from kernel configuration file.

So set the tunable BEFORE loading ipfw.  Check with '# ipfw show | tail' 
or similar to see your rules are really what you expected .. flushing 
wouldn't help if it's still defaulting to deny.

You may find it a better idea using firewall_enable=YES in /etc/rc.conf, 
with firewall_type=OPEN when that's what you want.  You can then change 
your firewall_type on the fly without rebooting - e.g. with sysrc(8) - 
using 'service ipfw restart'.

cheers, Ian