From owner-freebsd-questions@FreeBSD.ORG  Sun Nov 28 12:28:59 2004
Return-Path: <owner-freebsd-questions@FreeBSD.ORG>
Delivered-To: freebsd-questions@freebsd.org
Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125])
	by hub.freebsd.org (Postfix) with ESMTP id 30B5B16A4CE
	for <freebsd-questions@freebsd.org>;
	Sun, 28 Nov 2004 12:28:59 +0000 (GMT)
Received: from aiolos.otenet.gr (aiolos.otenet.gr [195.170.0.23])
	by mx1.FreeBSD.org (Postfix) with ESMTP id 9345C43D2F
	for <freebsd-questions@freebsd.org>;
	Sun, 28 Nov 2004 12:28:54 +0000 (GMT)
	(envelope-from keramida@ceid.upatras.gr)
Received: from gothmog.gr (patr530-b138.otenet.gr [212.205.244.146])
	iASCRkll000598;	Sun, 28 Nov 2004 14:27:47 +0200
Received: from gothmog.gr (gothmog [127.0.0.1])
	by gothmog.gr (8.13.1/8.13.1) with ESMTP id iASCRfCR043142;
	Sun, 28 Nov 2004 14:27:41 +0200 (EET)
	(envelope-from keramida@ceid.upatras.gr)
Received: (from giorgos@localhost)
	by gothmog.gr (8.13.1/8.13.1/Submit) id iASCRfct043141;
	Sun, 28 Nov 2004 14:27:41 +0200 (EET)
	(envelope-from keramida@ceid.upatras.gr)
Date: Sun, 28 Nov 2004 14:27:41 +0200
From: Giorgos Keramidas <keramida@ceid.upatras.gr>
To: Jonathon McKitrick <jcm@FreeBSD-uk.eu.org>
Message-ID: <20041128122741.GB43088@gothmog.gr>
References: <20041127215612.GA86416@dogma.freebsd-uk.eu.org>
	<20041128013135.GD662@gothmog.gr>
	<20041128044847.GA1435@dogma.freebsd-uk.eu.org>
Mime-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <20041128044847.GA1435@dogma.freebsd-uk.eu.org>
cc: freebsd-questions@freebsd.org
Subject: Re: Is this a hole in my firewall?
X-BeenThere: freebsd-questions@freebsd.org
X-Mailman-Version: 2.1.1
Precedence: list
List-Id: User questions <freebsd-questions.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-questions>,
	<mailto:freebsd-questions-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-questions>
List-Post: <mailto:freebsd-questions@freebsd.org>
List-Help: <mailto:freebsd-questions-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-questions>,
	<mailto:freebsd-questions-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Sun, 28 Nov 2004 12:28:59 -0000

On 2004-11-28 04:48, Jonathon McKitrick <jcm@FreeBSD-uk.eu.org> wrote:
> On Sun, Nov 28, 2004 at 03:31:35AM +0200, Giorgos Keramidas wrote:
> : AFAIK, rule 00300 will never be hit by packets going out tun0 as long as
> : you also have rule 00200 in there.
>
> Hmmm.... here's a run after having the laptop running for a bit.  I don't
> see why 200 doesn't cover the case either.
>
> root@neptune:~# ipfw show
> 00100    0       0 check-state
> 00200 6709 1277079 allow ip from me to any keep-state out xmit tun0
> 00300 2093  645797 allow ip from any to any keep-state out xmit tun0

Oops!  That doesn't look good, unless I'm missing something about the
way 'me' works.

It's probably a good idea to send what you have so far to the
freebsd-ipfw people.