Skip site navigation (1)Skip section navigation (2)
Date:      Mon, 14 Jul 2025 00:18:05 +0300
From:      Vadim Goncharov <vadimnuclight@gmail.com>
Cc:        freebsd-net <freebsd-net@freebsd.org>, FreeBSD Questions Mailing List <freebsd-questions@freebsd.org>
Subject:   Re: Issues with IPFW skipto Rule and Whitelisting Logic
Message-ID:  <20250714001805.073389b5@nuclight.lan>
In-Reply-To: <BFBEBAE0-E768-4E8D-9DB6-0AAD9D0EF931@cretaforce.gr>
References:  <3A01EF48-EBE8-48C3-9C66-6A250A240341@cretaforce.gr> <BFBEBAE0-E768-4E8D-9DB6-0AAD9D0EF931@cretaforce.gr>

next in thread | previous in thread | raw e-mail | index | archive | help
On Sun, 13 Jul 2025 23:53:25 +0300
Christos Chatzaras <chris@cretaforce.gr> wrote:

> > My intended logic is that any IP present in table(3) should always be
> > allowed, even if it or its subnet also appears in table(1).
> > 
> > For instance, 175.178.167.241 is in table(3), while 175.178.0.0/16 is
> > present in table(1).
> > 
> > After rebooting the server and populating the tables by running the update
> > script for the first time, access from 175.178.167.241 works correctly.
> > However, after subsequent runs of the update script - which only updates
> > unrelated entries and does not modify 175.178.167.241 or 175.178.0.0/16 -
> > access from 175.178.167.241 is no longer permitted.
> > 
> > Additionally, when this issue arises, adding 175.178.0.0/16 to table(3)
> > allows access again. Even after removing that entry, as long as
> > 175.178.167.241 remains in table(3) and I wait for any active sessions to
> > clear, access continues to work.  
> 
> To add more detail:
> 
> When this issue occurs, I can resolve it by just removing 175.178.167.241
> from table(3) and then immediately re-adding it to table(3).
> 
> These commands restores access for the IP:
> 
> ipfw table 3 delete 175.178.167.241
> 
> ipfw table 3 add 175.178.167.241

Did you try to remove `-q` from all your scripts and see if there are errors?
May be something in dmesg? Adding another log rules for your test IP? tcpdump?

-- 
WBR, @nuclight



Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20250714001805.073389b5>