Date: Wed, 10 May 2006 09:13:57 +1200 From: Andrew Thompson <thompsa@freebsd.org> To: freebsd-net@freebsd.org Subject: Re: ipfw divert with layer2 (if_bridge) packets Message-ID: <20060509211357.GA939@heff.fud.org.nz> In-Reply-To: <4460FF4E.10305@ifi.unicamp.br> References: <4460FF4E.10305@ifi.unicamp.br>
next in thread | previous in thread | raw e-mail | index | archive | help
On Tue, May 09, 2006 at 05:45:02PM -0300, Carlos E Gaspar wrote:
> Hi.
>
> I have the following setup:
>
> FreeBSD abc5.5-PRERELEASE FreeBSD 5.5-PRERELEASE #0: Wed Apr 26 14:58:22
> BRT 2006 root@abc:/usr/src/sys/alpha/compile/ABC alpha
>
> bridge0: flags=8043<UP,BROADCAST,RUNNING,MULTICAST> mtu 1500
> ether xx:xx:xx:xx:xx:xx
> priority 32768 hellotime 2 fwddelay 15 maxage 20
> member: de1 flags=3<LEARNING,DISCOVER>
> member: de0 flags=3<LEARNING,DISCOVER>
>
> de1 is my internal interface (local) and de0 the external (internet).
> host1 is on de1. Bridge works fine (if_bridge).
>
> With the following sysctl's:
>
> net.link.bridge.pfil_onlyip: 0
> net.link.bridge.pfil_member: 1
> net.link.bridge.pfil_bridge: 0
> net.link.bridge.ipfw: 0
^^^^^^^
This should be 1.
net.link.bridge.ipfw Set to 1 to enable layer2 filtering with
ipfirewall(4), set to 0 to disable it. This
needs to be enabled for dummynet(4) support.
When ipfw is enabled, pfil_bridge and
pfil_member will be disabled so that IPFW is
not run twice; these can be re-enabled if
desired.
Give that a try.
cheers,
Andrew
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20060509211357.GA939>