Date: Thu, 17 Sep 2015 01:05:50 +1000 (EST) From: Ian Smith <smithi@nimnet.asn.au> To: Warren Block <wblock@wonkity.com> Cc: "O. Hartmann" <ohartman@zedat.fu-berlin.de>, Kimmo Paasiala <kpaasial@gmail.com>, freebsd-net@freebsd.org, Lev Serebryakov <lev@freebsd.org>, freebsd-ipfw@freebsd.org Subject: Re: HELP! Mysterious socket 843/tcp listening on CURRENT system Message-ID: <20150916235555.F82084@sola.nimnet.asn.au> In-Reply-To: <alpine.BSF.2.20.1509150743500.99919@wonkity.com> References: <20150915090658.1e0b9074@freyja.zeit4.iv.bundesimmobilien.de> <CA%2B7WWSdW_JTL%2BKt_WcaLVDVLhtBnUGkXXNJezvTSkDy4rHLjPw@mail.gmail.com> <20150915094757.3daef42c@freyja.zeit4.iv.bundesimmobilien.de> <20150915201451.L90924@sola.nimnet.asn.au> <alpine.BSF.2.20.1509150743500.99919@wonkity.com>
next in thread | previous in thread | raw e-mail | index | archive | help
On Tue, 15 Sep 2015 07:51:11 -0600 (MDT), Warren Block wrote: > On Tue, 15 Sep 2015, Ian Smith wrote: > O. Hartmann wrote: > > > But that is an other issue and it is most likely > > > due to the outdated documentation (that doc still uses port 37 for NTP > > > purposes and referes to the outdated divert mechanism using natd, see the > > > recent handbook). The internet is also full of ambigous examples. > > > > Yes, the handbook IPFW section is still crazy after all these years, > > despite ongoing attempts to limit the damage. Best just ignore it. > > Best overall would be to fix the documentation. Oh, absolutely. But it can't be me, for reasons I'll mail you about. I've become reluctant to talk about what I can't fix, but when I see people in trouble due to that section, I'm compelled to so advise. > Given that there seems to be more interest in IPFW lately, it would > be nice if someone well-versed in it would repair or even rewrite the > IPFW handbook section. Rewrites are sometimes less work than fixing > an old section that no longer fits actual usage. Exactly the conclusion I'd come to after an effort last October to correct some of the more egregious errors, including the one Oliver mentions above and quite a lot else. In reviewing that today, I see I got some things wrong myself :) but I'll send it to you anyway. It's nothing more than a start, and only saved-as text, not in doc markup. > I have not used IPFW in years, but would be willing to help with an > edit/rewrite. Well if you're prepared to coordinate efforts, I'll certainly review and contribute as best I can. There was another offer in ipfw@ to assist in a rewrite recently. If you're up for it, I'll shunt that your way too? I've a feeling that the best way to do a lot of this would be by brief sections that mostly just pointed to sections of (online) ipfw(8); e.g. even the basic description is best covered by ipfw(8)'s /DESCRIPTION .. so a good index into that with some extra pointers and tips might work. But we really need some good examples of ipfw + nat with stateful rules that actually work properly. I found one saved good(-looking :) ruleset from 2012 with the sort of multiple interfaces and subnets Oliver needs, by Lev Serebryakov <lev@freebsd.org>, who's more recently been working on adding new rules to better handle timing/placement of state checking including in NAT scenarios, who I poke occasionally - like now - to provide some worked examples :) I think freebsd-ipfw@ may be a better place to take this now .. cc'd. cheers, Ian
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20150916235555.F82084>