From owner-freebsd-hackers@FreeBSD.ORG Tue Sep 28 10:36:25 2004 Return-Path: Delivered-To: freebsd-hackers@freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id 7FE1F16A4CE; Tue, 28 Sep 2004 10:36:25 +0000 (GMT) Received: from mail.star-sw.com (mail.star-sw.com [217.195.82.1]) by mx1.FreeBSD.org (Postfix) with ESMTP id 34FBE43D31; Tue, 28 Sep 2004 10:36:24 +0000 (GMT) (envelope-from nkritsky@star-sw.com) Received: from ARGON.star-sw.com (argon.star-sw.com [217.195.82.10]) by mail.star-sw.com (8.12.11/8.12.11) with ESMTP id i8SAaI7n009918; Tue, 28 Sep 2004 14:36:18 +0400 (MSD) Received: from ibmka.star-sw.com ([192.168.32.230]) by ARGON.star-sw.com with Microsoft SMTPSVC(5.0.2195.5329); Tue, 28 Sep 2004 14:23:56 +0400 Date: Tue, 28 Sep 2004 14:23:56 +0400 From: "Nickolay A. Kritsky" X-Mailer: The Bat! (v1.49) Personal X-Priority: 3 (Normal) Message-ID: <381891561234.20040928142356@star-sw.com> To: Zrelli Saber Ben Mohamed In-reply-To: <41593824.9030006@jaist.ac.jp> References: <41593824.9030006@jaist.ac.jp> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: 7bit X-OriginalArrivalTime: 28 Sep 2004 10:23:56.0537 (UTC) FILETIME=[42CE7690:01C4A545] X-Mailman-Approved-At: Tue, 28 Sep 2004 14:53:52 +0000 cc: freebsd-net@freebsd.org cc: hackers@freebsd.org cc: net@freebsd.org cc: freebsd-hackers@freebsd.org Subject: Re: divert , ipfw question X-BeenThere: freebsd-hackers@freebsd.org X-Mailman-Version: 2.1.1 Precedence: list Reply-To: "Nickolay A. Kritsky" List-Id: Technical Discussions relating to FreeBSD List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 28 Sep 2004 10:36:25 -0000 Hello Zrelli, the rule 65000 allow ip from any to any stops processing of a packet, so it will never reach diverting rule 65100. see man ipfw about rule-processing Tuesday, September 28, 2004, 2:08:36 PM, Zrelli Saber Ben Mohamed wrote: ZSBM> Hi , ZSBM> I'm interesed in the "divert" mechanism and want to try it out , ZSBM> so I recompiled the kernel ( FreeBSD 5.2.1-RELEASE #0 ) after adding the ZSBM> IPDIVERT option and then added the needed lines in the rc.conf file, ZSBM> after that , I set up ipfw to divert packets to some port ZSBM> here is my ipfw rule set . ZSBM> 00100 allow ip from any to any via lo0 ZSBM> 00200 deny ip from any to 127.0.0.0/8 ZSBM> 00300 deny ip from 127.0.0.0/8 to any ZSBM> 65000 allow ip from any to any ZSBM> 65100 divert 5000 ip from any 22 to me <---- the divert rule ZSBM> 65535 deny ip from any to any ZSBM> then, I wanted to monitor the diverted traffic using tcpdump : ZSBM> $ tcpdump port 5000 ZSBM> when I do a telnet connection to the port 22 from a remote host , I was ZSBM> expecting that tcpdump will display packets diverted to the port 5000 by ZSBM> ipfw. ZSBM> The remote host I use shows that it connects to port 22 and the ipfw ZSBM> divert rule seems not to work. ZSBM> I can set another rule to block the traffic in the port 22 , and it works. ZSBM> only the divert rule seems to fail. ZSBM> I wrote some piece of code using divert socket to read packets from the ZSBM> divert port , but no result ... ZSBM> I think I'm missing something , ZSBM> so please enlighten my mind ... ZSBM> Many Thanks ZSBM> -- ZSBM> Saber -- Best regards, ; Nickolay A. Kritsky ; SysAdmin STAR Software LLC ; mailto:nkritsky@star-sw.com