From owner-freebsd-net@FreeBSD.ORG  Thu May 13 01:35:45 2004
Return-Path: <owner-freebsd-net@FreeBSD.ORG>
Delivered-To: freebsd-net@freebsd.org
Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125])
	by hub.freebsd.org (Postfix) with ESMTP
	id 88C2216A4CE; Thu, 13 May 2004 01:35:45 -0700 (PDT)
Received: from cell.sick.ru (cell.sick.ru [217.72.144.68])
	by mx1.FreeBSD.org (Postfix) with ESMTP
	id 9207443D2D; Thu, 13 May 2004 01:35:44 -0700 (PDT)
	(envelope-from glebius@cell.sick.ru)
Received: from cell.sick.ru (glebius@localhost [127.0.0.1])
	by cell.sick.ru (8.12.9/8.12.8) with ESMTP id i4D8Zgvw031414
	(version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO);
	Thu, 13 May 2004 12:35:43 +0400 (MSD)
	(envelope-from glebius@cell.sick.ru)
Received: (from glebius@localhost)
	by cell.sick.ru (8.12.9/8.12.6/Submit) id i4D8Zg0S031413;
	Thu, 13 May 2004 12:35:42 +0400 (MSD)
Date: Thu, 13 May 2004 12:35:42 +0400
From: Gleb Smirnoff <glebius@cell.sick.ru>
To: Eugene Grosbein <eugen@kuzbass.ru>
Message-ID: <20040513083542.GD31159@cell.sick.ru>
References: <40A3393F.1391943E@kuzbass.ru>
	<20040513012344.A12373@xorpc.icir.org> <40A34082.F0182B31@kuzbass.ru>
Mime-Version: 1.0
Content-Type: text/plain; charset=koi8-r
Content-Disposition: inline
In-Reply-To: <40A34082.F0182B31@kuzbass.ru>
User-Agent: Mutt/1.5.6i
cc: Luigi Rizzo <rizzo@icir.org>
cc: ipfw@freebsd.org
cc: net@freebsd.org
Subject: Re: ipfw: reset tcp
X-BeenThere: freebsd-net@freebsd.org
X-Mailman-Version: 2.1.1
Precedence: list
List-Id: Networking and TCP/IP with FreeBSD <freebsd-net.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-net>,
	<mailto:freebsd-net-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-net>
List-Post: <mailto:freebsd-net@freebsd.org>
List-Help: <mailto:freebsd-net-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-net>,
	<mailto:freebsd-net-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Thu, 13 May 2004 08:35:45 -0000

On Thu, May 13, 2004 at 05:31:46PM +0800, Eugene Grosbein wrote:
E> > > When a rule 'reset tcp' matches, a kernel generates new TCP packet.
E> > > Will it have to go through ipfw list (from the beginning or not)?
E> > 
E> > ipfw2 uses an mbuf flag to bypass the firewall - I am not sure if i
E> > only used it for the keepalives or also for TCP reset packets
E> 
E> Please check. I suspect it does not enter ipfw itself,
E> it is not processed by my natd and bad things happen here.

According to send_pkt() in ip_fw2.c it does not pass firewall, since
M_SKIP_FIREWALL is set.

-- 
Totus tuus, Glebius.
GLEBIUS-RIPN GLEB-RIPE